Authentication

The Conversation API uses token-based authentication — it does not require client IPs to be whitelisted at the time of onboarding. Enterprises must use a bearer token generated using the credentials provided by Sinch India at the time of onboarding.

Generate Access Token

API Endpoint: https://auth.aclwhatsapp.com/realms/ipmessaging/protocol/openid-connect/token

Method: POST

Header Values

Name	Value
Cache-control	no-cache
Content-type	application/x-www-form-urlencoded

Data Object Values

Name	Description	Value
grant_type	Authentication method identifier	password
username	Provided by Sinch at time of onboarding	(your username)
password	Provided by Sinch at time of onboarding	(your password)

cURL Request

curl 'https://auth.aclwhatsapp.com/auth/realms/ipmessaging/protocol/openid-connect/token' \
  --header 'cache-control: no-cache' \
  --header 'content-type: application/x-www-form-urlencoded' \
  --data-urlencode 'grant_type=password' \
  --data-urlencode 'client_id=ipmessaging-client' \
  --data-urlencode 'username=<your_username>' \
  --data-urlencode 'password=<your_password>'

Response

Field	Description
access_token	Token value to be used for sending messages
expires_in	Time span for which the access token is valid (in seconds)
refresh_token	Used to regenerate the access token
refresh_expires_in	Time span for which the refresh token is valid (in seconds)
token_type	Fixed value: Bearer

{
  "access_token": "eyJhbGciOiJSUzI1NiIsInR5cCIgOiAi...",
  "expires_in": 300,
  "refresh_expires_in": 1800,
  "refresh_token": "eyJhbGciOiJIUzI1NiIsInR5cCIgOiAi...",
  "token_type": "Bearer",
  "not-before-policy": 0,
  "session_state": "f2cd48bf-d162-4754-b2c7-bdc9c97064b3",
  "scope": "email profile"
}

note

The access token expires in 300 seconds (5 minutes). Use the refresh_token to obtain a new access token without re-authenticating.