Authentication

All Channel Partner API requests are authenticated with a token passed in the request-token HTTP header.

How it works

POST /channel/api/v1/order/submit
  request-token: <your token>
        │
        ▼
  Server looks up the channel application by token
  (must be enabled and of type "channel_partner")
        │
        ▼
  Server resolves the bound channel partner (member) from the token
        │
        ▼
  Request proceeds, scoped to that partner's bound shops

The partner identity is resolved server-side from the token. You never send a partner id in the request — this prevents one partner from acting as another.

Obtaining a token

Tokens are issued by an e2c-energy administrator, who creates a channel application bound to your channel partner account. Keep the token secret; treat it like a password.

Request header

Header	Required	Description
request-token	yes	Your channel application token
Content-Type	yes	application/json

Authentication errors

code	Meaning
909	Token missing, unknown, disabled, or not of type channel_partner

When you receive 909, verify the token is correct, still enabled, and issued as a channel partner application.