Support

We're here to help! Browse our frequently asked questions below to find answers to common questions about getting started with the Odido API platform, accessing support, and troubleshooting issues.

Access & authentication

• Why can't I log in even though my account exists?

  This usually happens because the account hasn't been fully activated yet, the wrong login method is used, or you're trying to log in to the wrong environment.

  Make sure you're using the correct environment (for example, production vs. staging). Accounts and access rights are environment-specific, so an account that works in one environment may not exist in another. A quick check is to look at the URL in your browser to confirm you're in the right environment.

  Also check that the login method matches your account type:

  • External users log in using 2FA
  • Internal Odido users log in via SSO

  If the issue persists, try restarting the login flow or contact support.

• How does 2FA work and how can I change my 2FA method?

  When you log in for the first time, you're asked to set up two-factor authentication (2FA) using an authenticator app. 2FA works with most popular authenticator apps, such as Google Authenticator or Microsoft Authenticator.

  After setup, you'll need the authenticator app each time you log in. At the moment, it's not possible to change your 2FA app yourself.

  If you no longer have access to your authenticator app or device, contact support so your 2FA can be reset.

• What's the difference between SSO (internal) and 2FA (external)?

  The login method you use depends on how your account is set up.

  External users log in using a username and password combined with two-factor authentication (2FA) via an authenticator app. This adds an extra security layer for external access.

  Internal Odido users log in via Single Sign-On (SSO), using their Odido company credentials. This allows seamless access without setting up separate login details for the Developer Portal.

  The available login option is tied to your account and can't be switched manually.

• My access token expired. What should I do?

  Access tokens are time-limited for security reasons. They are assumed to expire after a fixed period of time.

  When a token expires, request a new access token using your refresh token or by re-authenticating, depending on the authentication flow you're using.

  If you keep running into expired tokens, check whether your application is correctly refreshing tokens before they expire.

• How can my organization add new users to the Developer Portal?

  User access is managed by your organization's administrator. To add new users, the admin needs to invite them through the Developer Portal's user management system.

  If you don't know who your organisation's administrator is, please contact support for assistance.

• How do I authenticate to the APIs?

  1. Go to My Apps under the My Dashboard from the profile menu. You will see all apps created by your organization.
     
  2. Click the App name you want to use for the API access.
     
  3. Inside App Details you can find the access request status.
  4. For the Approved access request you can see the Client Credentials under Access and Credentials Info with below details
     • Client ID
     • Client Secret
     • Authentication Method (OAuth2)
     • Redirect URLs
     • Expiry info
     • Under View Client Type Information per product
       • Grant Types (e.g., client_credentials)
       • Token Endpoint Auth Method (e.g., client_secret_basic)
       • Scope permissions (e.g.,: scope-soap-rest-bridge-demo)
  5. Use the above information to get Access token from Odido IDP by sending a POST HTTP request to the TOKEN endpoint
     
     • Dev: https://connect-dev.odido.nl/realms/tyk-dev-portal/protocol/openid-connect/token
     • Agile: https://connect-agile.odido.nl/realms/tyk-dev-portal/protocol/openid-connect/token
     • Staging: https://connect-staging.odido.nl/realms/tyk-dev-portal/protocol/openid-connect/token
     • Production: https://connect.odido.nl/realms/tyk-dev-portal/protocol/openid-connect/token
     • Sample curl request:

     Sample curl request:

     
                                         curl -X POST "" ^
                                         -H "Content-Type: application/x-www-form-urlencoded" ^
                                         --data-urlencode "client_id=" ^
                                         --data-urlencode "client_secret=" ^
                                         --data-urlencode "scope=" ^
                                         --data-urlencode "grant_type=client_credentials"
                                         

     Sample response:

     
                                         {
                                         "access_token": "eyJhbGciOi........",
                                         "expires_in": 300,
                                         "refresh_expires_in": 0,
                                         "token_type": "Bearer",
                                         "not-before-policy": 0,
                                         "scope": "scope1 scope2..."
                                         }
                                         

     • Use the access_token in the Authorization header in the actual API endpoint

       Sample request

                                         curl -X GET /endpoint \
                                         -H "Authorization: Bearer "
                                         

     Summary Flow

     
                                         Login → Explore Product → View OAS → Subscribe Plan →
                                         Create App → Retrieve Client ID/Secret →
                                         Generate Token → Call API
                                         

• What authentication methods are supported?

  OAuth 2.0 using the Client Credentials grant type.

• How do tokens work?

  Request an Access Token

  You send your client_id and client_secret to the Token Endpoint

  
                                      curl -X POST "" ^
                                      -H "Content-Type: application/x-www-form-urlencoded" ^
                                      --data-urlencode "client_id=" ^
                                      --data-urlencode "client_secret=" ^
                                      --data-urlencode "scope=" ^
                                      --data-urlencode "grant_type=client_credentials"
                                      

  What happens here?

  • Identity Provider validates:
    • client_id
    • client_secret
    • allowed scopes
  • If valid → returns an access token

  Token Response

  Sample response:

                                      {
                                      "access_token": "eyJhbGciOi....",
                                      "expires_in": 300,
                                      "refresh_expires_in": 0,
                                      "token_type": "Bearer",
                                      "not-before-policy": 0,
                                      "scope": "scope1 scope2..."
                                      }
                                      

  What each field means:

  Field	Meaning
  access_token	The actual JWT used to access APIs
  expires_in	Token validity (seconds)
  refresh_expires_in	Not used in client_credentials (usually 0)
  token_type	Always Bearer
  scope	Permissions granted

  Call the API Using the Token

  
                                      curl -X GET /endpoint ^
                                      -H "Authorization: Bearer "
                                      

  What happens now?

  • API Gateway (Tyk) validates the token by introspecting token with IdP
  • Checks:
    • Expiry
    • Signature
    • Scopes
  • If valid → request allowed
  • If invalid → 401 Unauthorized

  Request an Access Token

  You send your client_id and client_secret to the Token Endpoint

  
                                      curl -X POST "" ^
                                      -H "Content-Type: application/x-www-form-urlencoded" ^
                                      --data-urlencode "client_id=;" ^
                                      --data-urlencode "client_secret=" ^
                                      --data-urlencode "scope=" ^
                                      --data-urlencode "grant_type=client_credentials"
                                      

  What happens here?

  • Identity Provider validates:
    • client_id
    • client_secret
    • allowed scopes
  • If valid → returns an access token

  Token Response

  Sample response:

                                      {
                                      "access_token": "eyJhbGciOi....",
                                      "expires_in": 300,
                                      "refresh_expires_in": 0,
                                      "token_type": "Bearer",
                                      "not-before-policy": 0,
                                      "scope": "scope1 scope2..."
                                      }
                                      

  What each field means:

  Field	Meaning
  access_token	The actual JWT used to access APIs
  expires_in	Token validity (seconds)
  refresh_expires_in	Not used in client_credentials (usually 0)
  token_type	Always Bearer
  scope	Permissions granted

  Call the API Using the Token

  
                                      curl -X GET /endpoint ^
                                      -H "Authorization: Bearer "
                                      

  What happens now?

  • API Gateway (Tyk) validates the token by introspecting token with IdP
  • Checks:
    • Expiry
    • Signature
    • Scopes
  • If valid → request allowed
  • If invalid → 401 Unauthorized

• How often do tokens expire?

  Token expires in 300s.

• What scopes or permissions are required for an API?

  Scopes are:

  • Logical permission strings embedded inside the JWT access token
  • Used by the API Gateway to authorize access and tied to:
    • An API Product
    • A Subscription Plan
    • An Application (Client)

  How Scopes Are Determined

  In a Tyk + Developer Portal setup:

  A consumer subscribes to an API Product

  That product is linked to a Plan

  The Plan defines:

  • Rate limits
  • Quotas
  • Allowed APIs
  • Required scopes

  When the app is approved:

  • The OAuth client is configured with allowed scopes
  • The Identity Provider issues tokens with only those scopes

• What happens if my token expires or is revoked?

  There are two different scenarios:

  If the Access Token Expires

  What happens?

  • The API Gateway checks the exp claim in the JWT.
  • If expired → API returns 401 Unauthorized

  What should the client do?

  In client_credentials flow:

  • There is usually no refresh token
  • The client must request a new access token
  • This is done by calling the token endpoint again

  Best Practice

  Client applications should:

  • Cache the token
  • Track expires_in
  • Request a new token before expiry (or when receiving 401)
  • Handle retry logic gracefully

  If the Token Is Revoked

  Revocation can happen in multiple ways:

  • Client disabled in IdP by Odido Admin
  • App subscription revoked from developer portal
  • Product access removed in Tyk as part API lifecycle
  • Signing key rotated

  What happens?

  When the client tries to:

  • Use the token → API returns 401
  • Request a new token → Token endpoint may return: invalid_client or unauthorized_client

  If Client Access Is Revoked

  • The client_id and client_secret will no longer work
  • Token endpoint will reject the request

  What must the client do?

  Depending on the reason:

  Scenario	Action Required
  Secret rotated	Update new client_secret
  App deleted	Re-register app
  Subscription revoked	Re-subscribe to product
  Plan removed	Request new approval

  They may need to:

  • Re-register the application in the Developer Portal
  • Obtain new client credentials
  • Update configuration in their application

API usage & limits

• Are there usage quotas per API, product, or subscription?

  Currently, there are no usage quotas or limits on API calls for your subscription plan. You have unlimited access to the APIs available to you.

  If this changes in the future, we'll update the documentation and notify users accordingly.

• How can I monitor my API usage and limits?

  You can view your API usage and related information directly in the Developer Portal dashboard. This gives you insight into your request volumes and helps you keep track of your activity.

  Since there are currently no enforced rate limits or quotas, this overview serves mainly for your own monitoring and optimization.

• Are sandbox and production environments separated?

  Currently, we don't offer a separate sandbox environment. Instead, you can test API calls directly on the API documentation page with sample requests.

  All live API calls happen in the production environment, so please be cautious when testing.

• What's the difference between catalogues, products, plans, APIs, and endpoints?

  • Catalogues are collections of products that your account has access to.
  • Products are service groups within a catalogue, for example, Telecom Management.
  • Plans (if applicable) define different levels or packages within a product, often with varying features or limits.
  • APIs are the interfaces provided by a product to interact with its data or functions.
  • Endpoints are specific URLs within an API that let you perform actions or retrieve data.

  Your account grants access to one or more catalogues. Within those catalogues, you'll find products, each containing APIs, which in turn consist of multiple endpoints.

Key concepts

This section explains the core concepts used throughout the Developer Portal. Understanding these terms will help you navigate the portal and work with our APIs more effectively.

• Catalogue

  A catalogue is a collection of products that your account has access to. Access to catalogues is determined by your customer agreements.

  Your account can have access to one or multiple catalogues.

• Product

  A product represents a functional area or service. Each product contains one or more APIs.

• API

  An API exposes functionality of a product in a programmatic way. It defines what actions you can perform and what data you can retrieve or update.

  An API can consist of multiple endpoints.

• Endpoint

  An endpoint is a specific operation within an API. Each endpoint has:

  • a URL
  • an HTTP method (for example GET or POST)
  • defined request and response formats

  Endpoints are what your application ultimately calls.

• Account

  Your account determines:

  • which catalogues you can access
  • which products and APIs are visible
  • what permissions apply

  Accounts are always linked to a customer.

• Authentication

  Authentication is the process of proving who you are when calling an API. API requests must be authenticated using tokens.

• Authorization

  Authorization determines what you are allowed to do after you are authenticated. Access to APIs and endpoints depends on your account, permissions and customer agreements.

• Token

  A token is used to authenticate API requests. It must be included with each request and is typically valid for a limited period of time.

• Environment

  An environment refers to the context in which an API is used, such as production or test. Not all APIs or features are available in every environment.

Legal & Usage

What are the terms of use for the APIs?

All API usage is governed by the terms of use outlined in the Developer Portal Terms of Use. By accessing and using the APIs, you agree to comply with these terms.

Are there any restrictions on commercial use of the APIs?

Please refer to the API Usage Policy for detailed information on permitted use cases, including commercial restrictions and allowed activities.

Who owns the data returned by the APIs?

Ownership of data is defined in the Data Ownership Agreement. Generally, you retain ownership of your own data, while data provided via the APIs is subject to the respective service agreements.

Where can I find the full legal documentation?

All legal documents related to API usage, data protection, and compliance are available in the Legal Documentation section of the Developer Portal.