# 5-minute Quickstart

Start with application credentials, obtain tokens, and call your first protected endpoint.

## Prerequisites

Before you begin, confirm that the platform administrator has:

- Created and enabled an OpenAPI application.
- Registered and enabled the endpoints you need.
- Granted those endpoints to the application.
- Securely delivered the `app_key` and one-time `app_secret`.
- Provided the corresponding HTTPS base URL when using a non-production environment.

:::caution[Server-side use only]
The `app_secret`, Access Token, and Refresh Token are sensitive credentials. Never place them in browser code, mobile application packages, URL query parameters, Git repositories, or general-purpose logs.
:::

## 1. Configure connection details

```bash
export OPENAPI_BASE_URL="https://backend.biotech-mkt.com"
export OPENAPI_APP_KEY="ak_xxx"
export OPENAPI_APP_SECRET="sk_xxx"
```

Use the base URL above for production. Replace the credential examples with the real values supplied by the platform administrator.

## 2. Obtain tokens

```bash
curl --request POST "https://backend.biotech-mkt.com/openapi/auth/token" \
  --header "Content-Type: application/json" \
  --data "{\"app_key\":\"$OPENAPI_APP_KEY\",\"app_secret\":\"$OPENAPI_APP_SECRET\"}"
```

Successful response:

```json
{
  "code": 200,
  "message": "Success",
  "data": {
    "token_type": "Bearer",
    "app_id": 1,
    "app_key": "ak_xxx",
    "access_token": "oat_xxx",
    "expires_in": 86400,
    "access_expires_at": "2026-08-27 12:00:00",
    "refresh_token": "ort_xxx",
    "refresh_expires_in": 2592000,
    "refresh_expires_at": "2026-09-25 12:00:00"
  }
}
```

Immediately store both tokens in secure server-side storage. Do not rely on the example timestamps; use the values returned by the server.

## 3. Verify the caller identity

Store the Access Token returned by the server:

```bash
export OPENAPI_ACCESS_TOKEN="oat_xxx"
```

Call the diagnostic endpoint:

```bash
curl "https://backend.biotech-mkt.com/openapi/profile" \
  --header "Authorization: Bearer $OPENAPI_ACCESS_TOKEN"
```

If both the HTTP status and response `code` are `200`, and `data.app_key` matches your application, the token, endpoint registration, and application grant are active.

## 4. Call a business API

```bash
curl --get "https://backend.biotech-mkt.com/openapi/v1/doudian/order/union-settlement-orders" \
  --header "Authorization: Bearer $OPENAPI_ACCESS_TOKEN" \
  --data-urlencode "page=1" \
  --data-urlencode "page_size=20" \
  --data-urlencode "flow_point=SETTLE"
```

Page records are returned in `data.list`, and the total record count is returned in `data.total`. See [Douyin Selected Alliance Orders](/en/api/union-settlement-orders) for all query parameters and response fields.

## 5. Minimum production requirements

- Rotate tokens with the Refresh Token before the Access Token expires.
- A successful refresh invalidates the old tokens; atomically replace both stored tokens.
- Record `X-Request-Id`, but never log full credentials.
- On `429`, respect `Retry-After` instead of retrying immediately without a limit.
- On `401`, check whether the token expired or was revoked, or whether the application was disabled.