SnackMagic Authentication API

Stadium uses JWT (as Bearer token) for authentication. API provides 4 different methods to generate the token:1. Client Credentials2. Authorization Code (OAuth2)3. Authorization Code using PKCE4. Token using refresh tokenThe authentication method to be used depends on your use case - whether you want to place orders using a globalorganizer account or user's own Stadium Account and your implementation details.For each method, once you generate a _token_, it needs to be set as the _Bearer_ token in the **Authorization** header.The _token_ is valid for **24 hours**. The _token_ validity can be checked with our **Validate token** API endpoint.Once expired, a new _token_ will need to be generated using the same API endpoint as used earlier.### Client CredentialsThis should be used if you are an organizer and want to place an order or send points using a **global** organizer account.You can directly use the **Get Token** API endpoint to fetch the _token_ that can then be used in other APIs for authorization.### Authorization Code (OAuth2)This should be used if you want to place an order or send points on **behalf** of a Stadium user. This uses Oauth2 flow where you will needneed to make an **Authorize** request first. This will redirect the user to the Stadium login page and once they sign in, a *code* isreceived on the given `redirect_url`. Using this _code_, the _token_ can be fetched using the **Get Token by Code** API providing both`client_id` and `client_secret`. The `redirect_url` should be the same as given in the authorize call.### Authorization Code using PKCEIf you want to use the Authorization code method but cannot store the `client_secret` securely (like native application or SPA) you should usethis flow. In this you need to [generate a PKCE](https://developer.pingidentity.com/en/tools/pkce-code-generator.html) `code_challenge` and `code_verifier`using the SHA256 method. The `code_challenge` needs to sent as an additional param to the **Authorize** request. Once the _code_ is received send the`code_verifier` as the param (instead of `client_secret`) to the **Get Token by Code** API.### Token using refresh tokenYou can use this to issue a new access token using an existing access token and a refresh token.