Authentication

There are two types of authentication tokens:

• Partner's authentication token — generated and assigned for each partner to authenticate/authorise partner's access to the API. To request a partner token, contact us here.
• Practitioner's authentication token — generated by each practitioner to authorise access to their resources. Practitioners can generate a token by logging in to i-screen's practitioner portal and selecting the Access Token menu.

The server expects both API keys to be included in all API requests in a header formatted as:

Authorization: Bearer <Partner's token>-<Practitioner's token>

note

Replace <Partner's token> and <Practitioner's token> with your actual tokens. In some cases, only the partner's token is necessary (e.g. when creating a new practitioner). Leave the - separator in even when only the partner's token is provided.

warning

Never share your partner's token with anyone. The practitioner's token is typically used in a partner's platform to gain access to i-screen's resources. Practitioners can revoke existing tokens or create new tokens from i-screen's practitioner portal.

Token format

Both partner and practitioner tokens are opaque strings; treat them as secrets rather than parsing or relying on their structure, as the format may change over time. Tokens do not expire on a fixed schedule, but a practitioner can revoke and regenerate theirs at any time from the practitioner portal, which immediately invalidates the old value. If your integration starts receiving 401 Unauthorized after previously working, check whether the practitioner has rotated their token.

Examples

With both partner and practitioner tokens:

curl "https://partner-staging.i-screen.com.au/v1/practitioners" \
  -H "Authorization: Bearer f3ee05b1e3d140a3b17456fb69d28cd9-5f6a46513aa48d0bf80a04c7d52c9805633070a7803d3bd4"

With partner token only:

curl "https://partner-staging.i-screen.com.au/v1/practitioners" \
  -H "Authorization: Bearer f3ee05b1e3d140a3b17456fb69d28cd9-"