Authentication
The Virtimo BPC API offers various options for authenticating when calling endpoints. Depending on the use case and system configuration, different methods are available to ensure secure access. This page provides an overview of the supported authentication methods and their primary uses.
Available Authentication Methods
The BPC supports three basic types of authentication for the API. Select the appropriate method based on your system environment and security requirements.
API Keys
An API key corresponds to a static session in the BPC and contains attributes such as assigned organizations, roles, and permissions.
This method is recommended by default for calling API endpoints as well as for configuring deployment systems.
Authentication takes place directly during the API call by passing the key in the HTTP header X-APIKey.
For more information and configuration details, see API Keys.
Access Tokens
An access token is provided by a configured OpenID Connect provider.
Like a regular user session, this token contains attributes such as assigned organizations, roles, and permissions.
An issued access token is typically valid only for a short period of time.
It is transmitted as a bearer token in the Authorization header.
For more information, see Access Tokens.
User Login
In addition to API keys, you can also access the BPC API using traditional login credentials (username and password). Without an API key, this method requires a separate authentication call before accessing any API function. Please note that this type of login cannot be used if an OIDC-based identity provider is in use. For more information and a step-by-step guide, see API Authentication via User Login.
