Infor ION API OAuth Token Request Generator from an .ionapi File
This generator turns the properties of a downloaded .ionapi file into working Python, curl and PowerShell code that gets an OAuth 2.0 token, calls an API through the Infor ION API Gateway and revokes the token. It also lists the matching Postman settings for quick testing.
Fill in
Ends with /as/ in the .ionapi file
The part after {iu}/{ti}, starting with a slash, as shown in the API Gateway documentation for your suite
1. Python (requests): token, call, revoke
import requests
TI = 'TENANT_TST'
CI = 'TENANT_TST~clientid'
CS = 'client-secret'
PU = 'https://mingle-sso.example.com:443/TENANT_TST/as/'
OT = 'token.oauth2'
OR_PATH = 'revoke_token.oauth2'
IU = 'https://mingle-ionapi.example.com'
SAAK = 'TENANT_TST#access-key'
SASK = 'secret-key'
API_PATH = '/<SUITE>/<path>'
# 1. Resource owner password grant with the service account keys
token_resp = requests.post(
PU + OT,
data={
'grant_type': 'password',
'username': SAAK,
'password': SASK,
'client_id': CI,
'client_secret': CS,
},
timeout=60,
)
token_resp.raise_for_status()
token = token_resp.json()
access_token = token['access_token']
print('Token expires in (seconds):', token.get('expires_in'))
# 2. Call the API through the ION API Gateway
api_url = IU.rstrip('/') + '/' + TI + API_PATH
resp = requests.get(
api_url,
headers={'Authorization': 'Bearer ' + access_token, 'Accept': 'application/json'},
timeout=120,
)
print(resp.status_code)
print(resp.text[:2000])
# 3. Revoke the token when finished
revoke = requests.post(
PU + OR_PATH,
data={
'token': access_token,
'token_type_hint': 'access_token',
'client_id': CI,
'client_secret': CS,
},
timeout=60,
)
print('Revoke status:', revoke.status_code)2. curl
# Get a token curl -s -X POST 'https://mingle-sso.example.com:443/TENANT_TST/as/token.oauth2' \ --data-urlencode 'grant_type=password' \ --data-urlencode 'username=TENANT_TST#access-key' \ --data-urlencode 'password=secret-key' \ --data-urlencode 'client_id=TENANT_TST~clientid' \ --data-urlencode 'client_secret=client-secret' # Call the API (paste access_token from the response) curl -s 'https://mingle-ionapi.example.com/TENANT_TST/<SUITE>/<path>' \ -H 'Authorization: Bearer ACCESS_TOKEN' \ -H 'Accept: application/json' # Revoke curl -s -X POST 'https://mingle-sso.example.com:443/TENANT_TST/as/revoke_token.oauth2' \ --data-urlencode 'token=ACCESS_TOKEN' \ --data-urlencode 'token_type_hint=access_token' \ --data-urlencode 'client_id=TENANT_TST~clientid' \ --data-urlencode 'client_secret=client-secret'
3. PowerShell (Invoke-RestMethod)
$body = @{
grant_type = 'password'
username = 'TENANT_TST#access-key'
password = 'secret-key'
client_id = 'TENANT_TST~clientid'
client_secret = 'client-secret'
}
$token = Invoke-RestMethod -Method Post -Uri 'https://mingle-sso.example.com:443/TENANT_TST/as/token.oauth2' -Body $body -ContentType 'application/x-www-form-urlencoded'
Write-Output ('Expires in: ' + $token.expires_in)
$headers = @{ Authorization = 'Bearer ' + $token.access_token; Accept = 'application/json' }
$result = Invoke-RestMethod -Method Get -Uri 'https://mingle-ionapi.example.com/TENANT_TST/<SUITE>/<path>' -Headers $headers
$result | ConvertTo-Json -Depth 6
$revoke = @{
token = $token.access_token
token_type_hint = 'access_token'
client_id = 'TENANT_TST~clientid'
client_secret = 'client-secret'
}
Invoke-RestMethod -Method Post -Uri 'https://mingle-sso.example.com:443/TENANT_TST/as/revoke_token.oauth2' -Body $revoke -ContentType 'application/x-www-form-urlencoded'4. Postman OAuth 2.0 settings
| Postman setting | Value |
|---|---|
| Auth type | OAuth 2.0 |
| Grant type | Password Credentials |
| Access Token URL | https://mingle-sso.example.com:443/TENANT_TST/as/token.oauth2 |
| Username | TENANT_TST#access-key |
| Password | secret-key |
| Client ID | TENANT_TST~clientid |
| Client Secret | client-secret |
| Client Authentication | Send client credentials in body |
| Request URL | https://mingle-ionapi.example.com/TENANT_TST/<SUITE>/<path> |
Service account keys (saak, sask) appear only in .ionapi files downloaded for a backend service authorized app with a service account. Never commit the file or these values to source control; load them from a vault or environment variables in real code. Confirm the API path for your suite in the API Gateway documentation. The same file format and calls apply to on-premises Infor OS, with the authorization server on your own servers.
Get your ION API integration reviewed
Send us the API you need to call (no secrets) and we will check the path, app type and security roles before you build.
Optional. The tool and every export work without this. No spam.
What is in the .ionapi file
When an administrator registers an authorized app in ION API and downloads its credentials, Infor produces a JSON file with short property names. Open it in a text editor and copy each value into the matching field above; the property name is shown in each field label. The file also holds values this generator does not need, such as the authorize path used by web apps. The same structure applies on premises and in the cloud; only the host names differ. The properties used here are documented by Infor as follows.
- ti: tenant identifier; cn: application name
- ci and cs: client ID and client secret passed to the authorization server
- iu: base URL of the ION API Gateway for the tenant
- pu: base URL of the authorization server; oa, ot and or are paths appended to it for authorize, token and revoke (samples: authorization.oauth2, token.oauth2, revoke_token.oauth2)
- saak and sask: service account access key and secret key, used as username and password in the password grant
How the calls work
A backend service app authenticates with the resource owner password grant: POST to pu + ot with grant_type=password, username set to saak, password set to sask, plus client_id and client_secret, as a form-encoded body. The response contains access_token and expires_in. Every API call then goes to iu, the tenant and the product path, with the header Authorization: Bearer and the token. When the job finishes, POST the token to pu + or to revoke it so it cannot be reused. Read expires_in rather than hard-coding a lifetime, and request a new token when a call returns 401.
Worked example
Suppose the file has ti TENANT_TST, pu ending in /TENANT_TST/as/, ot token.oauth2 and iu of your ION API host. The token URL becomes the pu value followed by token.oauth2. To call an API whose documented path is /SUITE/resource, the full URL is iu + /TENANT_TST/SUITE/resource. The Python block prints the HTTP status and the first 2,000 characters of the response so you can confirm access before writing the real integration. If the token call fails with invalid_grant, the service account keys are wrong or were regenerated; if it fails with invalid_client, the ci or cs value is wrong.
Common mistakes
Using a web or desktop app type and expecting saak and sask: those only exist for a backend service app with a service account, which an administrator must create. Building the URL without the tenant segment after iu. Sending client credentials as Basic auth when Postman is set to body, or the reverse; pick one and keep it consistent. Committing the .ionapi file to git, which hands anyone with repository access a working service account. Holding one token for a long batch run instead of refreshing when it expires. On premises, forgetting to trust the internal certificate of the authorization server in Python or PowerShell.
Frequently Asked Questions
Where do I get Infor ION API credentials?
In Infor OS, an administrator opens ION API, goes to Authorized Apps, creates an app of the right type (backend service for server-to-server) and downloads the credentials, which produces the .ionapi file. For backend service apps a service account must be created to get saak and sask.
What is an Infor ION API service account?
It is a non-interactive identity tied to an Infor OS user, represented by the access key (saak) and secret key (sask) in the .ionapi file. The API runs with that user's security roles, so give it only the roles the integration needs.
How do I use the ION API in Postman?
Set Authorization to OAuth 2.0, grant type Password Credentials, Access Token URL to pu plus ot, username saak, password sask, client ID and secret from ci and cs, and client authentication to send credentials in body. Then call iu, tenant and path.
How long does an ION API token last?
Read the expires_in value in the token response; it is given in seconds and depends on the tenant configuration. Cache the token, track its expiry and request a new one before it lapses or when a call returns 401.
If you want to call Infor APIs from a private AI assistant on your own infrastructure, with read-only scopes and an audit log, we can build that integration.
Related Tools
Infor OS ION API and API Flow Payload and Timeout Calculator
Find a records-per-call batch size that stays inside ION API Gateway time-outs and API Flow payload limits, and estimate total run time.
Developer ToolsInfor ION BOD XML Shell Generator
Pick a verb and noun and get a correctly structured Infor OAGIS BOD envelope for ION, with the matching Acknowledge and ConfirmBOD skeletons.
Developer ToolsInfor ION Connection Point Types Reference (On-Premises and Cloud)
Compare ION connection point types by edition, how messages move, document types supported, Enterprise Connector need and typical use.
More Developer Tools tools
See all- Infor ION On-Premises Grid and Connector Health Checklist
- Infor Data Lake Compass SQL API Request Generator
- SAP Sales Order ABAP SELECT Generator (VBAK, VBAP, VBFA)
- SAP Sales Order Create BAPI ABAP Generator (BAPI_SALESORDER_CREATEFROMDAT2)
- SAP ABAP Open Items SELECT Generator
- SAP ACDOCA SQL Query Generator
- SAP QM Inspection Lot ABAP SELECT Generator
- SAP Quality Notification Pareto SQL Query Generator
- SAP QM Usage Decision BAPI Skeleton
Keep exploring
Free tools
- Infor M3 ION API Gateway OAuth 2.0 Python Client GeneratorGenerate a Python script that loads your .ionapi credentials file, gets and reuses an OAuth 2.0 token, and calls an M3 MI transaction through the on-prem ION API Gateway.
- SyteLine ION API IDO Request GeneratorTurn a .ionapi backend service file into working PowerShell and curl calls that load SyteLine IDO data through ION API, including bookmark paging.
- Business Central OAuth Token Request GeneratorBuilds the client credentials token request for Business Central online plus sample REST and OData calls using the returned token.
ERP fixes and how-tos
- Infor LN REST API: documentation, administration and a first callWhere Infor LN REST API documentation lives, how to enable and administer API access through ION API, and how to make a first authenticated call.
- Fix a 401 Unauthorized error from Infor ION APIFix a 401 Unauthorized error from Infor ION API by checking the .ionapi file, service account status, token expiry, and Authorized App settings.
- How to Create an .ionapi File and Service Account in Infor OSStep by step: register a Backend Service in ION API, create a service account, download the .ionapi file, and use it to get an OAuth token from Infor OS.
Guides
- SyteLine ION API Integration: The Complete GuideStep-by-step SyteLine ION API integration guide: API gateway setup, OAuth 2.0 tokens, BODs vs IDO endpoints, and secure on-prem to cloud connections.
- Infor ION Connect API Gateway Setup GuideConfigure Infor ION Connect API Gateway with OAuth2 authentication, endpoint registration, rate limiting, and external system integration for CloudSuite.
- Infor LN ION API Integration GuideInfor ION API guide for LN: when to use the ION API gateway, BOD messaging or file-based exchange, how OAuth 2.0 access works, and how to secure calls.