(Preferred)

Using Bearer tokens to make API requests is the preferred authentication method. Bearer tokens may be sent either via the Authorization HTTP header or as a URL query string parameter.

Bearer tokens should be kept secret and not included in source files, HTML pages or otherwise exposed. If you believe that your Bearer token has been exposed, please contact your Point representative and we will issue you a new token.

Below are examples of both kinds of requests using JavaScript & Axios. These examples make a call to calculate pricing for a property.

Using Authorization Header

async function requestUsingAuthHeader(secretBearerToken) {
  const url = `https://api.point.com/api/v2/eligibility/pricing`;

  const body = {
    address: {
      streetAddress: "76 Radish Ct",
      city: "Aptos",
      state: "CA",
      zip: "95003",
    },
  };

  const config = {
    headers: { Authorization: `Bearer ${secretBearerToken}` },
  };

  try {
    const response = await axios.post(url, body, config);
    return response.data;
  } catch (error) {
    console.log(error);
  }
}

Using Query String Parameter

async function requestUsingQueryString(secretBearerToken) {
  const url = `https://api.point.com/api/v2/eligibility/pricing?bearer=${secretBearerToken}`;

  const body = {
    address: {
      streetAddress: "76 Radish Ct",
      city: "Aptos",
      state: "CA",
      zip: "95003",
    },
  };

  try {
    const response = await axios.post(url, body);
    return response.data;
  } catch (error) {
    console.log(error);
  }
}

Consider using bearer tokens for authorization as they require less developer overhead when targeting the Point API.

When using HMAC authentication, any request to the API must include a Authorization header with a valid HMAC signature in the following format:

Authorization: HMAC-SHA256 ClientId=G0uZjwHGei0C;Timestamp=1596128186;Signature=e6b0269c10a15d0714255cd80a85a4fc671fd85d330b5138aa3878656774b500

Signature is the hash-based message authentication code produced by HMAC(secretKey, payload, 'sha256') where payload is the concatenation of method;URI;timestamp;body. The body clause should be omitted for requests that do not include a body.

• method is the HTTP request verb GET, PUT, etc.
• URI is the full URI of the request including any query parameters.
• timestamp is the unix timestamp in seconds.
• body is the JSON body of the request or an empty string.

For example, to sign a request in Javascript

function signRequest(requestParams, credentials) {
  const { clientSecret, clientId } = credentials;
  const { uri, method, body, headers } = requestParams;
  const timestamp = Math.round(new Date().getTime() / 1000);

  // construct the payload
  const payload = [method, uri, timestamp, body].filter(Boolean).join(';');

  // generate signature
  const hmac = crypto.createHmac('sha256', clientSecret);
  hmac.update(payload);
  const signature = hmac.digest('hex');

  // set authorization header
  headers.set('Authorization', `HMAC-SHA256 ClientId=${clientId};Timestamp=${timestamp};Signature=${signature}`);
}

Consult documentation online for how to produce a SHA256 encoded HMAC in your language.

You should have received authentication credentials from Point including a ClientId and ClientSecret. Please note that the ClientSecret is used to create a signature but is not included directly in API requests. This secret MUST be kept secure and should not be included in HTML pages or otherwise exposed. If you believe that your ClientSecret has been exposed, please contact your Point representative and we will issue you a new secret.