Authorizer API Overview

Introduction

The EchoSync Authorizer is the authentication service for the EchoSync platform. It validates your application credentials and issues Bearer tokens that grant access to EchoSync APIs. Every API request must include a valid Bearer token in its Authorization header.

Base URL

Production: https://auth.echo.com

Authentication

EchoSync Authorizer uses a token-based authentication flow. Submit your application credentials to receive a Bearer token, which must be included in every downstream API request.

Token Lifecycle

Important

Reuse your token until it expires. Do not request a new token on every API call. Cache the token and use it for its full validity period. Requesting new tokens repeatedly within the same validity window may trigger rate limiting.

Access tokens are valid for 86400 seconds (24 hours) from the time they are issued.
The endpoint /token response includes:
- expires_in — token lifetime in seconds (used to determine when the token should be refreshed)
- scope — the permissions granted to the token, defining which APIs it can access
A 401 Unauthorized response from any EchoSync API indicates the token is expired or invalid. In this case, request a new token and retry the request.

Rate Limiting

To ensure fair usage, maintain service availability, and protect system performance, requests may be subject to rate limiting. When usage exceeds allowed thresholds, requests can be temporarily throttled or rejected until the limit window resets.