Code Examples¶
Copy-paste-ready starting points demonstrating the complete integration: OAuth2 token management (mint, cache, proactive refresh), the dual-credential header model, single 401 retry, and every scenario in the canonical flow.
| Tool | What you get |
|---|---|
| cURL | Every endpoint as a shell command — the fastest way to poke the API |
| Python | requests-based client class |
| PHP | FsriPartnerClient class (Guzzle), full endpoint coverage |
| JavaScript | Node 18+ client, zero dependencies (built-in fetch) |
| Postman | 27-request collection with automatic token handling + Sandbox/Production environments |
Rules every example follows (keep them if you adapt the code)¶
- Server-side only. The client secret and API key never reach a browser or mobile app.
- Tokens are cached and refreshed ~5 minutes before their 1-hour expiry — never minted per-request.
- Both headers on every call:
Authorization: Bearer …andx-api-key. - PATCH uses
application/merge-patch+json— plain JSON PATCH is rejected. - 401 is retried exactly once (after a token refresh);
429/5xxget exponential backoff; other 4xx surface to the caller.