5-minute Quickstart

Prerequisites

Before you begin, confirm that the platform administrator has:

• Created and enabled an OpenAPI application.
• Registered and enabled the endpoints you need.
• Granted those endpoints to the application.
• Securely delivered the app_key and one-time app_secret.
• Provided the corresponding HTTPS base URL when using a non-production environment.

1. Configure connection details

export OPENAPI_BASE_URL="https://backend.biotech-mkt.com"
export OPENAPI_APP_KEY="ak_xxx"
export OPENAPI_APP_SECRET="sk_xxx"

Use the base URL above for production. Replace the credential examples with the real values supplied by the platform administrator.

2. Obtain tokens

curl --request POST "https://backend.biotech-mkt.com/openapi/auth/token" \
  --header "Content-Type: application/json" \
  --data "{\"app_key\":\"$OPENAPI_APP_KEY\",\"app_secret\":\"$OPENAPI_APP_SECRET\"}"

Successful response:

{
  "code": 200,
  "message": "Success",
  "data": {
    "token_type": "Bearer",
    "app_id": 1,
    "app_key": "ak_xxx",
    "access_token": "oat_xxx",
    "expires_in": 86400,
    "access_expires_at": "2026-08-27 12:00:00",
    "refresh_token": "ort_xxx",
    "refresh_expires_in": 2592000,
    "refresh_expires_at": "2026-09-25 12:00:00"
  }
}

Immediately store both tokens in secure server-side storage. Do not rely on the example timestamps; use the values returned by the server.

3. Verify the caller identity

Store the Access Token returned by the server:

export OPENAPI_ACCESS_TOKEN="oat_xxx"

Call the diagnostic endpoint:

curl "https://backend.biotech-mkt.com/openapi/profile" \
  --header "Authorization: Bearer $OPENAPI_ACCESS_TOKEN"

If both the HTTP status and response code are 200, and data.app_key matches your application, the token, endpoint registration, and application grant are active.

4. Call a business API

curl --get "https://backend.biotech-mkt.com/openapi/v1/doudian/order/union-settlement-orders" \
  --header "Authorization: Bearer $OPENAPI_ACCESS_TOKEN" \
  --data-urlencode "page=1" \
  --data-urlencode "page_size=20" \
  --data-urlencode "flow_point=SETTLE"

Page records are returned in data.list, and the total record count is returned in data.total. See Douyin Selected Alliance Orders for all query parameters and response fields.

5. Minimum production requirements

• Rotate tokens with the Refresh Token before the Access Token expires.
• A successful refresh invalidates the old tokens; atomically replace both stored tokens.
• Record X-Request-Id, but never log full credentials.
• On 429, respect Retry-After instead of retrying immediately without a limit.
• On 401, check whether the token expired or was revoked, or whether the application was disabled.