Authentication

Loady's public APIs require both client authentication and a subscription.

Environment

PG

API base URL

https://api-playground.loady.com/public

B2C authority

https://auth-playground.loady.com/auth-playground.loady.com

Token endpoint

https://auth-playground.loady.com/auth-playground.loady.com/b2c_1_sign_in_publicapi_flow/oauth2/v2.0/token

Scope

https://auth-playground.loady.com/publicapi/.default

OAuth 2.0 client credentials

Request a token with an application/x-www-form-urlencoded POST to the token endpoint shown above.

Send:

Code
grant_type=client_credentials
client_id={client_id}
client_secret={client_secret}
scope={scope}

Use the returned token as:

Code
Authorization: Bearer {access_token}

Tokens are time-limited. Use the expires_in value to refresh before expiry. Never send credentials to the API gateway itself.

Subscription key

Send the subscription key with every request:

Code
Ocp-Apim-Subscription-Key: {subscription_key}

The subscription key identifies and meters the customer integration; it does not replace OAuth. Rotate exposed credentials immediately through your Loady representative.

Try an API

Open any page under API Reference, expand Try this API, and enter the client ID, client secret, subscription key, and company ID provided by Loady. The portal obtains and refreshes the access token, then adds all required headers to requests from the built-in playground.

Every request targets the environment displayed in the form. Write and delete operations can change real data, including in PROD, and are the caller's responsibility.

Credentials remain only in the current tab's memory and are cleared by a page reload. They are sent directly to the configured Loady B2C and API endpoints, but remain visible to browser developer tools. Do not use the form on shared or untrusted devices.