Authentication

Embarc supports two authentication modes so you can align security posture with the environment in use.

Production – OAuth 2.1 JWT Bearer Tokens

Production environments rely on OAuth 2.1. Obtain a JWT access token from the Embarc identity service and attach it to every API call:

Authorization: Bearer <access-token>
TenantId: <tenant>

Tokens are short lived, stateless, and governed by enterprise policies (multifactor authentication, password rotation, device trust). Refresh the token whenever the platform returns 401 Unauthorized.

Sandbox – HTTP Basic

Sandboxes keep things simple with HTTP Basic for convenience during integration testing. Here, you would Base64 encodeusername:password and send it on each call:

Authorization: Basic <base64 credentials>
TenantId: <tenant>

Quick Reference

Regardless of mode, the tenant header remains mandatory so Embarc can route each request your Tenant.