Authentication

ASC Editor Plugin backend APIs use Application credentials and an Application-scoped access token.

Authentication summary

API credentials

Create Application credentials from:

Application -> Editor API -> Application Keys

The credential pair contains:

• Client ID
• Client Secret

Store both values on your backend. Never expose the Client Secret in browser code, mobile apps, logs, or public repositories.

Create an Application access token

Call POST /access/token from your backend using HTTP Basic Auth. The username is the Client ID and the password is the Client Secret.

The endpoint has no request body and does not create an End User.

curl -X POST 'https://api.aurorasendcloud.com/editor-plugin/access/token' \
  -H 'Authorization: Basic ZGVtb19jbGllbnRfaWQ6ZGVtb19jbGllbnRfc2VjcmV0'

The sample header contains the Base64-encoded value of:

demo_client_id:demo_client_secret

Response:

{
  "access_token": "example_access_token",
  "expires_in": 604800,
  "token_type": "Bearer"
}

The default lifetime is 604800 seconds (7 days). Keep the token on your backend and obtain a new one after it expires. Although the token uses JWT format, treat it as an opaque credential and do not depend on its internal claims.

Use the Application access token

Send the returned token as:

Authorization: Bearer <application_access_token>

Use it for:

• POST /access/code
• POST /resource/email
• GET /resource/email
• GET /resource/email/{emailId}
• PUT /resource/email/{emailId}
• DELETE /resource/email/{emailId}
• POST /resource/email/{emailId}/copy

Every Email Resource request must explicitly pass userId, even though the access token already identifies the Application.

Create a one-time editor code

Call POST /access/code with the Application access token and the End User ID from your own system. name, email, and phone are optional.

curl -X POST 'https://api.aurorasendcloud.com/editor-plugin/access/code' \
  -H 'Authorization: Bearer example_access_token' \
  -H 'Content-Type: application/json' \
  -d '{
    "userId": "user_12345",
    "name": "Jane Doe",
    "email": "[email protected]",
    "phone": "13800138000"
  }'

userId is required. Non-blank name, email, and phone values update the stored End User profile. Omitting an optional field, or passing null or an empty string, preserves its existing value. A non-empty email must use a valid email format and must not exceed 200 characters; phone must not exceed 50 characters.

Response:

{
  "code": "example_code",
  "expires_in": 300,
  "userId": "user_12345"
}

The code is single-use and expires after 5 minutes. Generate a new code every time the editor opens.

Open the editor

Return only the one-time code and public Email slug to the browser. Open the editor on the Application's active editor domain:

https://abc.editor.aurorasendcloud.com/thirdApp?code=example_code&id=b7e4a9c2d1f60835&lang=en_US

/thirdApp is an editor frontend route, not a third-party backend API. If the Application uses a custom editor domain, replace only the domain.

Credential boundaries