> For the complete documentation index, see [llms.txt](https://docs.facephi.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.facephi.com/docs.facephi-en/rest-api/midapi-v2/autenticacion.md).

# Authentication

The MIDAPI v2 endpoints are authenticated with a **consumer JWT Token** sent in the header `Authorization: Bearer <token>`. The Token is issued from the two concepts presented in [MIDAPI v2](/docs.facephi-en/rest-api/midapi-v2.md): the **customer platform** issues Tokens for its **consumers**, and each operational call is made on behalf of a consumer.

### Identification headers

| Header             | Description                                                                                                |
| ------------------ | ---------------------------------------------------------------------------------------------------------- |
| `platform-id`      | Identifies the customer platform. Required only when issuing the consumer Token (`POST /consumer/token`).  |
| `platform-api-key` | API Key for the customer platform. Required only when issuing the consumer Token (`POST /consumer/token`). |
| `consumer-id`      | Identifies the channel/consumer. Required in operational endpoints (`/storage` and `/v2/daf/*`).           |

### Operational endpoint requirements

All DAF endpoints require:

* **OAuth2 authentication**: header `Authorization: Bearer <token>`, obtained via `POST /consumer/token` (JWT signed with RS256, see below).
* Header **`consumer-id`**: consumer identifier. Required and non-empty.
* Header **`operation-id`**: business operation/session identifier. Required in `POST /v2/daf/validate` and in the status query `GET /v2/daf/{transactionId}`.

{% hint style="info" %}
MIDAPI v2 does not use authentication by `x-api-key`. The scheme is OAuth2 Bearer + `consumer-id` (and `operation-id` when starting validation and when querying status).
{% endhint %}

## Get the consumer Token

Before invoking any operational endpoint, the consumer must obtain a JWT Token and send it in the header `Authorization: Bearer <token>`. The Token is issued by Facephi and includes the `consumer-id` and the scopes corresponding to the services enabled for that consumer.

### Endpoint

```
POST /consumer/token
```

### Headers

| Name                 | Type   | Required | Description                              |
| -------------------- | ------ | -------- | ---------------------------------------- |
| **platform-id**      | string | **Yes**  | Identification of the customer platform. |
| **platform-api-key** | string | **Yes**  | API Key of the customer platform.        |

### Request body

**Content-Type:** `application/json`

#### Parameters

| Parameter    | Type   | Required | Description                                                                        |
| ------------ | ------ | -------- | ---------------------------------------------------------------------------------- |
| `consumerId` | string | **Yes**  | Identifier of the consumer (channel or vertical) for which the Token is requested. |

#### Request example

```json
{
  "consumerId": "<consumerId>"
}
```

### Responses

#### `200` Success

#### Response parameters

| Parameter    | Type   | Description                                                            |
| ------------ | ------ | ---------------------------------------------------------------------- |
| `consumerId` | string | Consumer for which the Token was issued.                               |
| `token`      | string | JWT Token to send in the header `Authorization: Bearer <token>`.       |
| `expiresAt`  | string | Expiration date and time of the Token in ISO 8601 format **ISO 8601**. |

#### Response example

```json
{
  "consumerId": "<consumerId>",
  "token": "<jwt>",
  "expiresAt": "2026-06-26T13:00:00.000Z"
}
```

{% hint style="info" %}
The Token has a **validity of 1 hour** from its issuance (the exact expiration instant is returned in the field `expiresAt`). Once expired, it is enough to request a new one using the same endpoint. On each request, the signature, issuer, the `consumer-id`, expiration, and scopes of the Token are validated.
{% endhint %}