> For the complete documentation index, see [llms.txt](https://the-wishlist-documentation.gitbook.io/the-wishlist-documentation-docs/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://the-wishlist-documentation.gitbook.io/the-wishlist-documentation-docs/rest-api-reference/overview.md).

# Overview

The Wishlist Authentication API is used to get the access token for invoking The Wishlist APIs. To generate a token, an HTTP post API call should be made to the authentication server.

Any API call must contain the access token in the authorization header. (Field name is **Authorization** and format is **Bearer \<access\_token>**).

The default credentials to get the access token are created when a tenant (i.e. webstore) is registered with The Wishlist. You will require a client\_id and a secret.

As part of the POST you should pass the grant type ***client\_credentials***, and client\_id and client\_secret with the values provided by us. The API call must also contain **X-TWC-Tenant**, with the value being your unique **tenant ID**. The content type should be **'Content-Type: application/x-www-form-urlencoded'**

**Base URL:** `https://auth.au-aws.thewishlist.io`

***NOTE. DO NOT STORE WISHLIST REST API CREDENTIALS IN YOUR FRONT-END. Either extend the backend of your e-commerce system to make the API calls to The Wishlist and send the information to the frontend from there, or create an integration layer that communicates with both your ecommerce backend and The Wishlist, and make the frontend use the API layer. Exposing the secret in the front-end is a major security risk, but will also result in CORS errors***