Authentication and Credentials

Choose token or signature mode and manage platform credentials correctly.

Station OpenAPI SDK supports Access Token authentication and AppKey/SecretKey signature authentication. Each StationOpenApiClient must use exactly one mode.

Obtain Credentials from Technical Support

Before integration, contact your assigned technical support representative to obtain:

• The Station OpenAPI endpoint for the target environment;
• Either an Access Token or an AppKey and SecretKey pair;
• The business operations permitted by those credentials.

The endpoint is the platform root address beginning with http:// or https://. Credentials are environment-specific. Do not mix credentials from test and production environments.

Choose an Authentication Mode

Mode	Required configuration	Authentication data sent by the SDK
Access Token	accessToken	HTTP header X-Access-Token
Signature	appKey, secretKey	appKey, timestamp, nonce, and sign in the request body

Use the mode for which technical support supplied credentials. The Sample enables the Token profile by default and can be switched to the signature profile.

In signature mode, secretKey participates only in local signature generation and is never sent as a request field. The SDK creates fresh authentication fields for every request attempt. Business code must not generate signatures itself.

In Token mode, the SDK sets X-Access-Token automatically. Do not add the same header again through an application interceptor.

Spring Boot Configuration

See the Spring Boot Quickstart for complete configuration. The Sample provides these working references:

• application.yml
• application-token.yml
• application-signature.yml
• StationOpenApiConfiguration.java

Token mode must contain only the Access Token. Signature mode must contain only the AppKey and SecretKey. The Sample rejects mixed credentials during application startup.

Clock Requirements for Signature Mode

Signatures contain the current timestamp, so the host running the application must keep an accurate system clock. If Token authentication works but signature authentication repeatedly fails, check the system time first, then confirm that the AppKey and SecretKey belong to the current platform environment.

Use client.system().getTimeText() to verify basic connectivity and authentication.

Credential Handling Rules

• Never commit real credentials to a public GitHub repository.
• Never expose complete credentials in logs, exceptions, Swagger examples, or API responses.
• Never place secretKey in a business request model.
• Never allow external callers to submit platform credentials through your business APIs.
• Contact technical support when credentials expire, become invalid, or need replacement.