Skip to main content

Who is this article for?

CrashPlan Cloud
CrashPlan for Small Business

Find your product plan in the Code42 console on the Account menu.
Not a CrashPlan Cloud customer? Search or browse CrashPlan for Small Business or Incydr and Instructor.

Instructor, no.

Incydr Professional, Enterprise, Gov F2, and Horizon, no.

Incydr Basic, Advanced, and Gov F1, no.

CrashPlan Cloud, yes.

Retired product plans, yes.

CrashPlan for Small Business, no.

Code42 Support

CrashPlan API authentication methods


Most requests to the Code42 API must be authenticated. This article describes the available Code42 API authentication methods and provides examples of their use.


Comparison of Code42 API authentication methods

The Code42 API offers the following authentication methods:

The following table describes the advantages and disadvantages of each authentication method:

Authentication method Advantages Disadvantages
Obtain a token with an API client
  • Better performance than basic authentication
  • More secure than a token obtained with a username and password
    • Utilizes a secret that can be reset if needed
    • Tokens expire in 15 minutes
  • More complex to use than basic authentication 

Use basic authentication 

Simple to use
  • Passwords may be saved in the history of your tool
  • Not allowed for version 3 resources, except for the resource that provides a token
  • Deprecated

Use basic authentication to obtain a token

  • Better performance than basic authentication
  • More secure than basic authentication
    (tokens expire in 30 minutes)
  • More complex to use than basic authentication
  • Not as secure as a token obtained with an API client

Obtain a token with an API client

To obtain a token, first create an API client

After you create an API client and have saved the client ID and secret, submit the information to obtain an authentication token. 

Request the token with the /api/v3/oauth/token resource:

curl -X POST -u '<clientID>:<secret>' -H "Accept: application/json" "<requestURL>/api/v3/oauth/token?grant_type=client_credentials"

In the example (which uses curl), replace <ClientID> with the API client ID and replace <Secret> with the API client secret. Replace <request_url> with the URL of your Code42 cloud instance:

For example:

curl -X POST -u 'key-79muGw9i424:DWL-mPQ' -H "Accept: application/json" ""

A successful request returns an authentication token. For example:


Use the authentication token (also known as a bearer token) in all your API requests. For example, following is an API request to get a list of users:

curl -X GET '' -H "authorization: Bearer eyJjdHkiO_bxYJOOn28y...5HGtGHgJzHVCE8zfy1qRBf_rhchA" 

Use basic authentication

Basic authentication is deprecated. Instead, use basic authentication to obtain a tokenFor more information about this and other API deprecations, see Code42 API release notes.

To use basic authentication, include your Code42 username in the API request and supply your password when prompted.

curl -u "username" <request_url>/api/v1/Computer

Replace <request_url> with the address of your Code42 environment (do not include the brackets in your request). 

You can use basic authentication for any version 1 or 4 and later resource, and version 3's /auth/jwt resource. 

Use basic authentication to obtain a token

Request URLs

The request URL you use in your authentication request depends on your Code42 cloud address. Use the following request URLs:

Step 1: Get the token

  1. Include your Code42 username in a GET request to auth/jwt and supply your password when prompted.
    curl -u "username" <request_url>/api/v3/auth/jwt?useBody=true

    Replace <request_url> with the address of your Code42 environment (do not include the brackets in your request). 

    Authentication cookies are not supported
    You must include the ?useBody=true  query parameter in the auth/jwt   request to return the token in the response body. Omitting the ?useBody=true query parameter or using ?useBody=false results in the token being returned in an authentication cookie, which is not supported by the Code42 API. Include the returned token in subsequent API requests using the authorization header with the Bearer scheme, for example, -H 'authorization: Bearer <token>'

    If your organization uses two-factor authentication for local users, you must also include a totp-auth header value containing the six- to eight-digit Time-based One-Time Password (TOTP) supplied by the Google Authenticator mobile app. (Sending the request without the TOTP displays the error message TIME_BASED_ONE_TIME_PASSWORD_REQUIRED.) The example below includes a TOTP value of 424242.

    curl -u "username" -H "totp-auth: 424242" https://<request_url>/api/v3/auth/jwt?useBody=true 
  2. From the reply, copy the value of the v3_user_token. In the example below, it is eyJjdHki...txd546Eg

Step 2: Use the token in API requests

Include that token in API requests. For example:

curl --header 'Authorization: Bearer '$tkn <request_url>/api/v1/User
curl --header 'Authorization: Bearer '$tkn <request_url>/api/v3/org/<organizationID>/user
curl -H 'Authorization: Bearer '$tkn <request_url>/api/v4/role/view

Replace <request_url> with the address of your Code42 environment (do not include the brackets in your request). 

Related topics

  • Was this article helpful?