Authentication

Base URL

Send API requests over HTTPS. For production requests, use this base URL, except for token requests, which use the separate endpoints below: https://api.hill-laboratories.com/client

Authenticate with the Hill Labs API using OAuth 2.0. The access token is a JSON Web Token (JWT). Include it in the Authorization request header using the Bearer scheme.

Access Token

Your access token expires after approximately 24 hours. Request a new access token when it expires.

Each new token is valid for 24 hours. The short expiry helps protect your credentials.

Endpoint

Testing: https://cat-api.hill-laboratories.com/client/oauth/token

Production: https://api.hill-laboratories.com/client/oauth/token

Required Headers

Content-Type: application/json

Example Request

Hill Labs will provide you with a username and password. Use these credentials to request an access token for the API.

To get an access token, send a POST request with the following details:

{
  "username":"[username]",
  "password":"[password]"
}

Example Response

Use the returned access token as a bearer token in subsequent requests.

{
  "access_token": "xx...xx",
  "expires_in": 86400,
  "token_type": "Bearer"
}

Possible Responses

Code	Description	When
200	Token issued	Your credentials are accepted. The response contains an access token.
400	Bad Request	The request body is missing or cannot be read as JSON. Send the request body as JSON.
401	Unauthorized	Your username or password is rejected. The response includes `error: invalid_grant`.
500	Internal Server Error	An unexpected error occurs while issuing the token. Try again later and contact the Hill Labs support team if it continues.

Security Considerations

Store your username and password securely on your server. Do not put them in browser code or other client-side storage.

Contact the Hill Labs support team if you notice a security issue.