Skip to main content
The NSEV WebPortal API supports two authentication methods. Which one you use depends on how your organization has configured the platform. Credentials are provisioned by the Nitro delivery team - see Platform Access if you have not received yours yet.

​
Basic Authentication

Traditional HTTP Basic Authentication using a username and password provisioned for your tenant.

​
OAuth 2.0 (Bearer token)

When your organization has an identity provider (IDP) configured, you authenticate with an OAuth2 access token (a JWT or opaque token) sent as a Bearer token:
Two OAuth2 flows are available:
  • Client Credentials (machine-to-machine) - full API access, including administrative endpoints. Ideal for server-to-server integrations.
  • Authorization Code (user-based) - the app acts on behalf of a signed-in user, with that user’s own permissions (not the full tenant-wide access that Client Credentials grants). Administrative endpoints are excluded. Ideal for user-facing applications.
Administrative endpoints (such as /poisonqueue and /absenceperiods) are restricted to machine-to-machine (Client Credentials) authentication.
The exact security requirements for each operation are declared in the API Reference. To verify your credentials work, see Make your first call.