Using token in API calls

Once your application has successfully obtained an access_token, you can use it to make authenticated requests to Happeo's APIs. The access_token must be included in the Authorization header of your HTTP requests, using the Bearer scheme.

Standard Header Format:

Authorization: Bearer YOUR_ACCESS_TOKEN

This tells Happeo that your application is authorized to access the requested resources on behalf of the user who granted permission.

Example API Call: Listing User's Channels

Let's say you want to fetch a list of channels the user has access to. The Happeo API for this is GET https://api.happeo.com/channels.

Example Request (Conceptual JavaScript with Fetch API):

JavaScript

const accessToken = "YOUR_OBTAINED_ACCESS_TOKEN"; // Retrieve the access token from your storage

async function getUserChannels() {
  const channelsUrl = 'https://api.happeo.com/channels';

try {
    const response = await fetch(channelsUrl, {
      method: 'GET',
      headers: {
        'Authorization': `Bearer ${accessToken}`, // Include the access token here
        'Content-Type': 'application/json' // Often good practice, though not always strictly required for GET
      }
    });

if (!response.ok) {
      // Handle non-2xx responses (e.g., 401 Unauthorized, 403 Forbidden)
      if (response.status === 401) {
        console.error('Unauthorized: Access token might be expired or invalid. Attempt refresh.');
        // Implement token refresh logic here
      }
      throw new Error(`API call failed with status: ${response.status}`);
    }

const data = await response.json();
    console.log('User Channels:', data);
    return data;

} catch (error) {
    console.error('Error fetching user channels:', error);
    // Handle network errors or other exceptions
    throw error;
  }
}

// Call the function to fetch channels:
// getUserChannels();

Important Considerations:

• Token Expiry: Access tokens have a limited lifespan (indicated by expires_in when you obtain it). If you try to use an expired token, Happeo will return an error (typically a 401 Unauthorized status). You should then use your refresh_token (if available) to obtain a new access_token.
• Error Handling: Always implement robust error handling for API calls, especially for 401 Unauthorized responses, which usually indicate an expired or invalid token.
• Secure Storage: Ensure your access_token and refresh_token are stored securely within your application (e.g., in memory for access tokens, http-only cookies or secure storage for refresh tokens) and are not exposed to client-side attacks like XSS.