POST v1/Authenticate/2FA

Authentication with optional two factor flow.

URI template

v1/Authenticate/2FA?sendEmail={sendEmail}

Request Information

URI Parameters

NameDescriptionTypeAdditional information
sendEmail

Set to true when using authenticator two factor authentication method to receive email containing information to setup authenticator.

boolean

Default value is False

Body Parameters

Object containing a user's email and password

InLoginWithDevice
NameDescriptionTypeAdditional information
DeviceId

Device Id of the remembered device

string

None.

Email

string

Required

Password

string

Required

Request Formats

application/json, text/json

Sample:
{
  "DeviceId": "sample string 1",
  "Email": "sample string 2",
  "Password": "sample string 3"
}

application/xml, text/xml

Sample:
<InLoginWithDevice xmlns:i="http://www.w3.org/2001/XMLSchema-instance" xmlns="http://schemas.datacontract.org/2004/07/OnlineOrderingAPI.Inbound">
  <Email>sample string 2</Email>
  <Password>sample string 3</Password>
  <DeviceId>sample string 1</DeviceId>
</InLoginWithDevice>

Response Information

Resource Description

AuthenticationMethod None: Http status code 200 with access token information and id_token containing customer information base64 encoded.
AuthenticationMethod Email: Http status code 303 with two factor authentication method in the id_token base64 encoded. An email with a code will be sent to the email of the account, which can be validated using the GET v1/Authenticate/2FA call.
AuthenticationMethod Authenticator: Http status code 303 with two factor authentication method and data to setup an authenticator in the id_token base64 encoded. Use either the ManualEntryKey or a QR code generated using the QrCodeData to setup an authenticator that will provide a 6-digit code, which can be verified using the GET v1/Authenticate/2FA call.

GenerateCodeResult
NameDescriptionTypeAdditional information
auth_code

string

None.

access_token

The token required for all authenticated calls. Expires after expires_in_seconds seconds have elapsed

string

None.

refresh_token

This token is used to request a new access_token when the previous one expires

string

None.

expires_in_seconds

The number of seconds until the access_token expires

decimal number

None.

id_token

Customer and two factor authentication information base64 encoded e.g. Id, LoyaltyId etc. This string will always be deserializable as a valid json object and the "path" to CustomerId, LoyaltyId etc. will never change. Making it a string allows us to add extra pieces of information if necessary for folks who might need them, without breaking our contract with everyone else

string

None.

Response Formats

application/json, text/json

Sample:
{
  "auth_code": null,
  "access_token": "eyJFbmNyeXB0ZWREYXRhIjoiN1BndHpFbXVTcE1xYUZ2djZlRzFKQUVNUlNDdmtPK1dNWGJVU1diSTlPVVp3bkNGbWlHQ29yWmJTcEdnaUdIdklaR1ZVVFl0eDg0ODM1K1V1MHUxYllRVGhySlo3NUZVN05BYXJwVkxuUGhPRENFd3VDOU9jVFIrV3NHOHZxdnJVRVRCa2dWNnRiS1Z6UllGemhwY0VyNXJwU3NNK2p5MG03VGQvMUJVQXRLVGYzcjVHQVhJL3VVWktUSDlETlc0UXI2WDZrb1V2ekc2dlBuTXVhdXpoUT09IiwiSXYiOiJxMmFwRVY3amZrZy9VUEhWbW5kZmhBVVJqamw1TlUvSXNoSStnM0NaMlZnPSJ9",
  "refresh_token": "eyJFbmNyeXB0ZWREYXRhIjoienNKR1JYb1h0azExNlV3T282SGM0bjc0dTFSYUZwc29KT2dkVm85VnRUST0iLCJJdiI6IlpvWG02WVZtTE5ROVBZVFk1WHd2eWtBdEJRM0pWNE9xMER3YnlZYmo0RlU9In0=",
  "expires_in_seconds": 1800.0,
  "id_token": "eyJDdXN0b21lcklkIjoiNjBlNmY4MzgtYzU5ZC00NWZhLWE1YWYtOWNmY2JhYTQ0MDcyIiwiTG95YWx0eUlkIjoiIiwiTWFudWFsRW50cnlLZXkiOm51bGwsIklzc3VlciI6bnVsbCwiQ3VzdG9tZXJFbWFpbCI6InRlc3RAbmNyLmNvbSIsIlFyQ29kZURhdGEiOm51bGwsIlR3b0ZhY3RvckF1dGhNZXRob2QiOiJFbWFpbCJ9"
}
Result:
{Results of your json query will appear here}

application/xml, text/xml

Sample:
<GenerateCodeResult xmlns:i="http://www.w3.org/2001/XMLSchema-instance" xmlns="http://schemas.datacontract.org/2004/07/OnlineOrderingAPI.Models.v1.Response">
  <access_token>eyJFbmNyeXB0ZWREYXRhIjoiN1BndHpFbXVTcE1xYUZ2djZlRzFKQUVNUlNDdmtPK1dNWGJVU1diSTlPVVp3bkNGbWlHQ29yWmJTcEdnaUdIdklaR1ZVVFl0eDg0ODM1K1V1MHUxYllRVGhySlo3NUZVN05BYXJwVkxuUGhPRENFd3VDOU9jVFIrV3NHOHZxdnJVRVRCa2dWNnRiS1Z6UllGemhwY0VyNXJwU3NNK2p5MG03VGQvMUJVQXRLVGYzcjVHQVhJL3VVWktUSDlETlc0UXI2WDZrb1V2ekc2dlBuTXVhdXpoUT09IiwiSXYiOiJxMmFwRVY3amZrZy9VUEhWbW5kZmhBVVJqamw1TlUvSXNoSStnM0NaMlZnPSJ9</access_token>
  <auth_code i:nil="true" />
  <expires_in_seconds>1800</expires_in_seconds>
  <id_token>eyJDdXN0b21lcklkIjoiNjBlNmY4MzgtYzU5ZC00NWZhLWE1YWYtOWNmY2JhYTQ0MDcyIiwiTG95YWx0eUlkIjoiIiwiTWFudWFsRW50cnlLZXkiOm51bGwsIklzc3VlciI6bnVsbCwiQ3VzdG9tZXJFbWFpbCI6InRlc3RAbmNyLmNvbSIsIlFyQ29kZURhdGEiOm51bGwsIlR3b0ZhY3RvckF1dGhNZXRob2QiOiJFbWFpbCJ9</id_token>
  <refresh_token>eyJFbmNyeXB0ZWREYXRhIjoienNKR1JYb1h0azExNlV3T282SGM0bjc0dTFSYUZwc29KT2dkVm85VnRUST0iLCJJdiI6IlpvWG02WVZtTE5ROVBZVFk1WHd2eWtBdEJRM0pWNE9xMER3YnlZYmo0RlU9In0=</refresh_token>
</GenerateCodeResult>