Authentication

This page explains how to authenticate before calling protected endpoints.

Prerequisites

Before you begin, ensure you have the following credentials from your Panta account manager:

Parameter	Type	Description
client_id	String	Your OAuth2 client identifier
client_secret	String	Your OAuth2 client secret
username	String	Your Panta platform username
password	String	Your Panta platform password
tenant_id	String	Your client/tenant ID for API requests

All credentials are environment-specific. The base URLs in this guide point to the DMO environment. Your account manager will confirm the correct environment URLs for your integration.

Token endpoint

To obtain an access token, send a POST request to the Keycloak token endpoint:

POST https://login.dmo.app.pantaindex.com/realms/panta-technology/protocol/openid-connect/token

Request headers

Header	Description
Content-Type	application/x-www-form-urlencoded

Request body parameters

Parameter	Type	Description
client_id	String	Your OAuth2 client ID
client_secret	String	Your OAuth2 client secret
grant_type	String	Must be password
username	String	Your Panta username
password	String	Your Panta password

Example request

curl -X POST \
  "https://login.dmo.app.pantaindex.com/realms/panta-technology/protocol/openid-connect/token" \
  -H "Content-Type: application/x-www-form-urlencoded" \
  -d "client_id=YOUR_CLIENT_ID" \
  -d "client_secret=YOUR_CLIENT_SECRET" \
  -d "grant_type=password" \
  -d "username=YOUR_USERNAME" \
  -d "password=YOUR_PASSWORD"

Example response

{
  "access_token": "eyJhbGciOi...",
  "expires_in": 300,
  "refresh_token": "...",
  "token_type": "Bearer"
}

Notes

• The access token expires after 300 seconds (5 minutes).
• Your application should request a new token before the current one expires, or handle 401 Unauthorized responses by re-authenticating.
• Protected API requests must include both Authorization: Bearer <token> and X-CLIENT-ID: <your_tenant_id>.