Authentication

Token Generation for SESTEK Cloud SR Service

SESTEK Cloud Speech Recognition (SR) service uses bearer tokens for authentication and authorization. These tokens are required to access API endpoints securely.

When your subscription is created, a Client ID and Client Secret are generated in the SESTEK Portal and sent to you. Use these credentials to generate tokens as described below.

Authentication Endpoint

To obtain an authentication token, send a request to the following endpoint:

Endpoint:

https://identity.ldm.knovvu.com/connect/token

Token Request Process

REST Service Client Actions	REST Service Actions
POST Get Integration Token (SESTEK Portal endpoint)	Generates a bearer token for authentication.
Required Parameters (Body):	`client_id`, `client_secret`, `grant_type=client_credentials`, `scope=Ldm_Integration`
Business Rules:	Subscription must be valid.

The grant_type and scope values above are fixed; do not change them. Only client_id and client_secret are specific to your subscription.

Example Token Request (cURL)

curl --location 'https://identity.ldm.knovvu.com/connect/token' \
--header 'Content-Type: application/x-www-form-urlencoded' \
--data-urlencode 'client_id=[your_client_id]' \
--data-urlencode 'client_secret=[your_client_secret]' \
--data-urlencode 'grant_type=client_credentials' \
--data-urlencode 'scope=Ldm_Integration'

Example Token Response

{
    "access_token": "[your_token]",
    "expires_in": 31536000,
    "token_type": "Bearer",
    "scope": "Ldm_Integration"
}

Token Validity and Expiry

Access tokens issued by the SESTEK Portal are valid for one year (365 days) from the moment of generation.

Once generated, the same token can be used for API requests until it expires.
After one year, the token must be renewed by generating a new one using the same process.
Store the token's expires_in value alongside its generation timestamp, and request a new token before it lapses, so integrations do not fail unexpectedly on expiry.

Troubleshooting

The following responses were confirmed by sending real requests to the endpoint:

Cause	HTTP Status	Response
Invalid `client_id` or `client_secret`	401	`{"error": "invalid_client", "error_description": "The specified 'client_id' is invalid."}`
`grant_type` missing	400	`{"error": "invalid_request", "error_description": "The mandatory 'grant_type' parameter is missing."}`
`grant_type` is not `client_credentials`	400	`{"error": "invalid_request", "error_description": "..."}` (the exact message depends on the grant type attempted)
`client_secret` missing	400	`{"error": "invalid_request", "error_description": "The 'client_secret' or 'client_assertion' parameter must be specified when using the client credentials grant."}`
`scope` value is not `Ldm_Integration`	400	`{"error": "invalid_scope", "error_description": "The specified 'scope' is invalid."}`

If your client_id and client_secret are correct but you still receive invalid_client, confirm your subscription is active, then contact your SESTEK Sales Operations contact.

Documentation Index