Authentication

ASC Editor Plugin backend APIs use Application credentials and an Application-scoped access token.

Authentication summary

API credentials

Create Application credentials from:

Application -> Editor API -> Application Keys

The credential pair contains:

• Client ID
• Client Secret

Store both values on your backend. Never expose the Client Secret in browser code, mobile apps, logs, or public repositories.

Create an Application access token

Call POST /access/token from your backend using HTTP Basic Auth. The username is the Client ID and the password is the Client Secret.

The endpoint has no request body and does not create an End User.

curl -X POST 'https://api.aurorasendcloud.com/editor-plugin/access/token' \
  -H 'Authorization: Basic ZGVtb19jbGllbnRfaWQ6ZGVtb19jbGllbnRfc2VjcmV0'

The sample header contains the Base64-encoded value of:

demo_client_id:demo_client_secret

Response:

{
  "access_token": "example_access_token",
  "expires_in": 604800,
  "token_type": "Bearer"
}

The default lifetime is 604800 seconds (7 days). Keep the token on your backend and obtain a new one after it expires. Although the token uses JWT format, treat it as an opaque credential and do not depend on its internal claims.

Use the Application access token

Send the returned token as:

Authorization: Bearer <application_access_token>

Use it for:

• POST /access/code
• POST /resource/email
• GET /resource/email
• GET /resource/email/{emailId}
• PUT /resource/email/{emailId}
• DELETE /resource/email/{emailId}
• POST /resource/email/{emailId}/copy
• GET /resource/ai/quota
• GET /resource/ai/balances
• GET /resource/ai/bills
• GET /resource/ai/usage
• PUT /resource/ai/end-user-quota-limit

Every Email Resource request must explicitly pass userId, even though the access token already identifies the Application. AI Resource API endpoints operate at the Application level; userId is an optional query filter on /resource/ai/usage and a required field in the request body of /resource/ai/end-user-quota-limit. The Application must have the AI capability enabled to access any /resource/ai endpoint.

Create a one-time editor code

Call POST /access/code with the Application access token and the End User ID from your own system. name, email, phone, and extra are optional.

curl -X POST 'https://api.aurorasendcloud.com/editor-plugin/access/code' \
  -H 'Authorization: Bearer example_access_token' \
  -H 'Content-Type: application/json' \
  -d '{
    "userId": "user_12345",
    "name": "Jane Doe",
    "email": "[email protected]",
    "phone": "13800138000",
    "extra": {
      "variables": [
        {
          "category": "Customer Attributes",
          "name": "Member Level",
          "value": "member_level",
          "preview": "Gold Member",
          "description": "User current membership level"
        }
      ]
    }
  }'

userId is required. Non-blank name, email, and phone values update the stored End User profile. Omitting an optional field, or passing null or an empty string, preserves its existing value. A non-empty email must use a valid email format and must not exceed 200 characters; phone must not exceed 50 characters.

End User variables (extra.variables)

extra.variables dynamically injects custom End-User-level variables into the editor session when generating the one-time code, making placeholders available for template design.

Response:

{
  "code": "example_code",
  "expires_in": 300,
  "userId": "user_12345"
}

The code is single-use and expires after 5 minutes. Generate a new code every time the editor opens.

Open the editor

Return only the one-time code and public Email slug to the browser. Open the editor on the Application's active editor domain:

https://abc.editor.aurorasendcloud.com/thirdApp?code=example_code&id=b7e4a9c2d1f60835&lang=en_US

/thirdApp is an editor frontend route, not a third-party backend API. If the Application uses a custom editor domain, replace only the domain.

Credential boundaries