Authentication in Dropship - Fabric

Getting an Access Token

API clients are required to have both a client_id and client_secret to generate an authentication token. The following steps outline how to get your required credentials.

  1. Log in to fabric Dropship.
  2. In the top navigation, click Merchant or Supplier Settings from the merchant/supplier dropdown. The dropdown will match your merchant/supplier name. The Merchant or Supplier Settings page is displayed.
  3. Click API Clients. The API Clients page is displayed with a list of all your active API clients.
  4. Click Add API Client. The Create API Client window is displayed.
  5. In the Client Name field, enter a client name. This name will be used to differentiate each of your API clients. You can have multiple API clients as needed.
  6. Click Create Client. The API client is created and appears in the API Clients table.
  7. Click the name of the API client you just created. The Client Credentials page is displayed. On this page, you can see an Authentication URL used to generate a token, your API URL, Retailer ID or Brand ID, and client_id. The Retailer ID or Brand ID is used in most API calls as a required path parameter depending on if you are using merchant or brand API endpoints.
  8. In the Client Secret field, click Get Client Secret. The API Secret window is displayed with a warning message.

You will only be able to see your API secret once. If you lose it, you will have to generate a new set of credentials.

  1. Click Show API Secret. The API Secret is displayed; save this secret somewhere secure. This is used as the client_secret. You now have the credentials needed to generate an access token.
  2. To obtain an access token, you must authenticate using the Client Credentials grant type. The request body should be x-www-form-urlencoded as shown below.
curl --location --request POST 'https://marketplace-api.fabric.inc/auth/token/'
--header 'accept: application/json'
--header 'cache-control: no-cache'
--header 'content-type: application/x-www-form-urlencoded'
--data-urlencode 'grant_type=client_credentials'
--data-urlencode 'client_id={{clientId}}'
--data-urlencode 'client_secret={{clientSecret}}'

The following JSON response is returned:

HTTP/1.1 200 OK
{
  "access_token": "0oW0r4m1pjIlb5UJujZA5iVuse0XSn",
  "token_type": "Bearer",
  "expires_in": 36000,
  "scope": "read write"
}

After an access token has been obtained, you can make requests to protected endpoints by including your access token in the Authorization header.