Get Token

API Overview

Exchanges an API account's email address and secret key for an access token. Call this endpoint first: every other endpoint in this documentation requires the token returned here.

Request Information

• Method: POST
• Path: /api/login
• Authentication: None (this endpoint issues the token)

Request Headers

Field	Description
Content-Type	application/json

Request Parameters

The request body is in JSON format and includes the following fields:

Parameter	Type	Required	Description
UserName	string	Yes	The account email address assigned by WMG. Must be a valid email address, maximum 64 characters.
Password	string	Yes	The account secret key assigned by WMG. Between 8 and 64 characters.

Request Body Example

{
    "UserName": "your_account@example.com",
    "Password": "your_secret_key"
}

Authentication

This endpoint requires no authentication.

Apply the returned Token to every subsequent request by setting the Authorization header:

Authorization: Bearer eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9...

Response Information

The response is in JSON format.

Response Format

Field	Type	Description
Code	integer	0 = success; non-zero = failure
Message	string	Human-readable result
Data	object	Payload; empty array [] on failure

Success Response

• Status Code: 200

{
    "Code": 0,
    "Message": "Success",
    "Data": {
        "Token": "eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJpYXQiOjE3MTAzODExMzIsIm5iZiI6MTcxMDM4MTEzMiwiaWQiOjJ9.CoafVH75GhgwJjgBZEfqqISY45mgRBb-4La4qdCH2p0",
        "Expire": 1710409932
    }
}

Field	Type	Description
Data.Token	string	Access token. Send it as Authorization: Bearer <Token> on all other endpoints.
Data.Expire	integer	Absolute expiry time, as a 10-digit UNIX timestamp in seconds.

Error Response

• Status Code: 200 (business logic error) or 4xx/5xx (system error)

{
    "Code": 1,
    "Message": "Invalid Email or Key.",
    "Data": []
}

Code Reference

Code	Description
0	Success
1	Failure

Example

Bash

BASE_URL="https://api.postal.test.wmgdelivery.com"

curl -X POST "$BASE_URL/api/login" \
  -H "Content-Type: application/json" \
  -d '{"UserName":"your_account@example.com","Password":"your_secret_key"}'

Windows PowerShell

$BASE_URL = "https://api.postal.test.wmgdelivery.com"

$body = @{
    UserName = "your_account@example.com"
    Password = "your_secret_key"
} | ConvertTo-Json

$response = Invoke-RestMethod -Uri "$BASE_URL/api/login" -Method Post `
    -ContentType "application/json" -Body $body
$response | ConvertTo-Json -Depth 10

# Cache this token and reuse it until it is close to Data.Expire
$token = $response.Data.Token

Python

import requests

BASE_URL = "https://api.postal.test.wmgdelivery.com"

resp = requests.post(f"{BASE_URL}/api/login", json={
    "UserName": "your_account@example.com",
    "Password": "your_secret_key",
}, timeout=10)
payload = resp.json()
print(payload)

# Cache this token and reuse it until it is close to Data.Expire
token = payload["Data"]["Token"]

Node.js / TypeScript

const BASE_URL = "https://api.postal.test.wmgdelivery.com";

const res = await fetch(`${BASE_URL}/api/login`, {
  method: "POST",
  headers: {"Content-Type": "application/json"},
  body: JSON.stringify({
    UserName: "your_account@example.com",
    Password: "your_secret_key",
  }),
});
const payload = await res.json();
console.log(payload);

// Cache this token and reuse it until it is close to Data.Expire
const token = payload.Data.Token;

PHP

<?php
$BASE_URL = 'https://api.postal.test.wmgdelivery.com';

$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $BASE_URL . '/api/login');
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_HTTPHEADER, ['Content-Type: application/json']);
curl_setopt($ch, CURLOPT_POSTFIELDS, json_encode([
    'UserName' => 'your_account@example.com',
    'Password' => 'your_secret_key',
]));
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_TIMEOUT, 10);
$response = curl_exec($ch);
curl_close($ch);

$payload = json_decode($response, true);
echo json_encode($payload, JSON_PRETTY_PRINT | JSON_UNESCAPED_UNICODE) . "\n";

// Cache this token and reuse it until it is close to Data.Expire
$token = $payload['Data']['Token'];
?>

Notes

• The token is valid for 1 hour (3600 seconds) from issue. Read Data.Expire rather than hard-coding the lifetime — it is the authoritative expiry.
• Only one token per account is active at a time. Requesting a new token invalidates the token issued previously, so cache the token and reuse it until it is close to expiry instead of logging in on every request.
• There is no refresh endpoint. Once a token expires, call this endpoint again.
• The token is normally sent as Authorization: Bearer <Token>. An x-token: <Token> header is also accepted.
• All parameters are case-sensitive.

Error Codes

code	message	Description
1	Invalid Email or Key.	No API account matches the supplied UserName and Password.
1	Login fail	The account matched, but the token could not be issued. Retry; if it persists, contact tech@wmg-group.com.
1	UserName require	UserName is missing or empty.
1	UserName not a valid email address	UserName is not a valid email address.
1	max size of UserName must be 64	UserName is longer than 64 characters.
1	Password require	Password is missing or empty.
1	min size of Password must be 8	Password is shorter than 8 characters.
1	max size of Password must be 64	Password is longer than 64 characters.
1	Error encountered, please contact tech@wmg-group.com with screenshot of error page for resolution.	Unexpected server error.
1003	Token error	Returned by the other endpoints when the token is missing, expired, or superseded by a newer login. Call this endpoint again to obtain a new token.