Authentication & API Tokens

Every request to the Frisbii Media REST API must be authenticated with a Frisbii Media Token — a signed JWT sent as the X-plenigo-token request header.

Creating a token in the Merchant Backend

1. Log in to the Frisbii Media Merchant Backend

2. Navigate to Settings → Developer

3. Create a new API Access Token

4. You will need at least write access to Settings to create a token

Keep your token secret. Do not expose it in frontend code, client-side JavaScript, or public repositories.

Token structure

The token is a JWT signed with HS256 using your company secret key as the signing key.

Payload fields

Code examples

C#

class Plenigo
{
    public static string CreatePlenigoToken()
    {
        var unixEpoch = new DateTime(1970, 1, 1, 0, 0, 0, DateTimeKind.Utc);
        var now = Math.Round((DateTime.UtcNow - unixEpoch).TotalSeconds);
        var payload = new Dictionary<string, object>()
        {
            { "jti",       System.Guid.NewGuid().ToString() },
            { "aud",       "plenigo" },
            { "exp",       Math.Floor((now + 5 * 60 * 1000) / 1000) },
            { "companyId", "COMPANY_ID" }
        };
        var secretKey = "secret";
        string token = JsonWebToken.Encode(payload, secretKey, JWT.JwtHashAlgorithm.HS256);
        return token;
    }
}
WebClient client = new WebClient();
client.Headers.Add("plenigoToken", Plenigo.CreatePlenigoToken());

Go

import (
    jwt  "github.com/dgrijalva/jwt-go"
    "github.com/satori/go.uuid"
    "time"
)
func generateToken(companyId string, companySecret string) string {
    token := jwt.NewWithClaims(jwt.SigningMethodHS256, jwt.MapClaims{
        "companyId": companyId,
        "exp":       time.Now().Add(time.Minute * time.Duration(5)).Unix(),
        "aud":       "plenigo",
        "jti":       uuid.NewV4(),
    })
    tokenString, err := token.SignedString([]byte(companySecret))
    if err != nil {
        // handle error
    }
    return tokenString
}

Using the token in API requests

Pass the token as a header on every API request:

$response = $client->request('POST', 'customers', [
    'headers' => ['X-plenigo-token' => eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9],
    'json'    => $payload,
]);

Important notes

• Never reuse a jti — each request must have a unique identifier

• Keep expiry short — 5 minutes is the recommended maximum

• Server time must be accurate — token validation will fail if your server clock is skewed. Run NTP.

• The token in the code examples throughout this documentation (eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...) is a placeholder for illustration only and will not work against the API