---
title: "Authentication & API Tokens"
slug: "authentication-api-tokens"
updated: 2026-07-09T05:03:33Z
published: 2026-07-09T05:03:33Z
canonical: "help.frisbii.com/authentication-api-tokens"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://help.frisbii.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication & API Tokens

Every request to the Frisbii Media REST API must be authenticated with a **Frisbii Media Token** — a signed JWT sent as the `X-plenigo-token` request header.

---

## Creating a token in the Merchant Backend

1. Log in to the Frisbii Media Merchant Backend
2. Navigate to **Settings → Developer**
3. Create a new API Access Token
4. You will need at least **write access to Settings** to create a token

Keep your token secret. Do not expose it in frontend code, client-side JavaScript, or public repositories.

---

## Token structure

The token is a **JWT signed with HS256** using your company secret key as the signing key.

### Payload fields

| Field | Description |
| --- | --- |
| `jti` | A unique identifier for this request. Must never be reused (prevents replay attacks). Use a UUID or similar. |
| `aud` | Must always be the string `"plenigo"` |
| `exp` | Token expiry as a Unix timestamp. Recommended: current time + 5 minutes |
| `companyId` | Your Company ID from the merchant backend |

---

## Code examples

### C#

```csharp
class Plenigo
{
    public static string CreatePlenigoToken()
    {
        var unixEpoch = new DateTime(1970, 1, 1, 0, 0, 0, DateTimeKind.Utc);
        var now = Math.Round((DateTime.UtcNow - unixEpoch).TotalSeconds);
        var payload = new Dictionary<string, object>()
        {
            { "jti",       System.Guid.NewGuid().ToString() },
            { "aud",       "plenigo" },
            { "exp",       Math.Floor((now + 5 * 60 * 1000) / 1000) },
            { "companyId", "COMPANY_ID" }
        };
        var secretKey = "secret";
        string token = JsonWebToken.Encode(payload, secretKey, JWT.JwtHashAlgorithm.HS256);
        return token;
    }
}
WebClient client = new WebClient();
client.Headers.Add("plenigoToken", Plenigo.CreatePlenigoToken());
```

### Go

```go
import (
    jwt  "github.com/dgrijalva/jwt-go"
    "github.com/satori/go.uuid"
    "time"
)
func generateToken(companyId string, companySecret string) string {
    token := jwt.NewWithClaims(jwt.SigningMethodHS256, jwt.MapClaims{
        "companyId": companyId,
        "exp":       time.Now().Add(time.Minute * time.Duration(5)).Unix(),
        "aud":       "plenigo",
        "jti":       uuid.NewV4(),
    })
    tokenString, err := token.SignedString([]byte(companySecret))
    if err != nil {
        // handle error
    }
    return tokenString
}
```

---

## Using the token in API requests

Pass the token as a header on every API request:

```php
$response = $client->request('POST', 'customers', [
    'headers' => ['X-plenigo-token' => eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9],
    'json'    => $payload,
]);
```

---

## Important notes

- **Never reuse a** `jti` — each request must have a unique identifier
- **Keep expiry short** — 5 minutes is the recommended maximum
- **Server time must be accurate** — token validation will fail if your server clock is skewed. Run NTP.
- The token in the code examples throughout this documentation (`eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...`) is a **placeholder for illustration only** and will not work against the API