Igniter Media

Authentication & Authorization

IgniterMedia.com is an OAuth 2.0 provider. Use of the V2 API requires the client to have pre-registered an application to allow user authentication & authorization.

To describe the function of consuming our OAuth 2.0 API, we'll use this diagram taken from RFC 6749, the official word on OAuth.

In step A, we ask the authorization server to grant authorization to our client. The authorization server should prompt the user for recognition of this application; if granted, then access and refresh tokens are issued. The access token has a time-to-live value associated with it.

When downloading protected resources (steps C and D), the access token must be presented. If an expired or invalid token is presented, it will be rejected; the client should then attempt a refresh (step G.) If the refresh fails, client should start over from step A.

+--------+                                           +---------------+
|        |--(A)------- Authorization Grant --------->|               |
|        |                                           |               |
|        |<-(B)----------- Access Token -------------|               |
|        |               & Refresh Token             |               |
|        |                                           |               |
|        |                            +----------+   |               |
|        |--(C)---- Access Token ---->|          |   |               |
|        |                            |          |   |               |
|        |<-(D)- Protected Resource --| Resource |   | Authorization |
| Client |                            |  Server  |   |     Server    |
|        |--(E)---- Access Token ---->|          |   |               |
|        |                            |          |   |               |
|        |<-(F)- Invalid Token Error -|          |   |               |
|        |                            +----------+   |               |
|        |                                           |               |
|        |--(G)----------- Refresh Token ----------->|               |
|        |                                           |               |
|        |<-(H)----------- Access Token -------------|               |
+--------+           & Optional Refresh Token        +---------------+

Creating an Application

To get started, please request that an OAuth application be created for the sites on which you want to access protected resources. You will have to provide the callback URL your application will use to handle an access grant, and the scopes your application needs. When the application is created, you will then receive two magic numbers: a client_id and a client_secret. These two numbers will be used in your app, so store them appropriately.

Your application can only request the scopes it was registered with. If you need the products scope, ask for it when the application is created; a request for a scope your application is not registered for is rejected with an invalid_scope error.

Scopes

Scopes limit what an access token may do. Each endpoint documented below requires a particular scope, and a token that was not granted that scope is refused with 403.

Available scopes

read: default; See the user's name, email address, and current membership. Required by GET /v2/me.
products: optional; Download full-resolution files for products the user's membership includes. Required by GET /v2/products/:id.
warehouse: optional; Server-to-server data warehouse access. Granted only through the client credentials grant, never to a user.

Requesting scopes

Request scopes with the scope argument when requesting the grant, separated by spaces: scope=read products (URL-encoded as scope=read%20products). If you omit scope, the token is granted only read.

The user is shown each requested scope on the consent screen. The scope value in the access token response lists the scopes that were granted, and a renewed access token keeps the scopes of the original grant.

Requesting the Grant

In order to prompt the user to grant the access, you need to open a browser window. In that browser window, make a request to the /oauth/authorize endpoint.

Arguments

api_domain: required; www.ignitermedia.com
client_id: required; The Client ID received in the previous step.
response_type: required; The string code
redirect_uri: required; The callback URI you provided when the application was created. These must match exactly or your request will be rejected.
scope: optional; The scopes to request, separated by spaces, e.g. read products. Defaults to read. Each scope must be one your application is registered for.

Returns

Nothing...kinda.

No, really— what happens?

When the user grants access to your application, the registered callback URI will be triggered so you can receive our authorization code. When your server receives the callback, https://yourapp/opensesame?code=1928dbb28h... you are really only concerned with the value of the code query string parameter. That is your authorization code.

That authorization code is what you will exchange to get an access token!

GET /oauth/authorize

curl -X GET \
  -d "client_id={client_id}" \
  -d "response_type={response_type}" \
  -d "redirect_uri={redirect_uri}" \
  -d "scope=read%20products" \
  https://{api_domain}/oauth/authorize

N/A

Getting an Access Token

Post a request to the /oauth/token endpoint in order to retrieve a access and refresh token that you can use to access a protected resource (or refresh an expired access token).

client_id: required; The Client ID received when the application was created.
client_secret: required; The client secret received when the application was created.
redirect_uri: required; The callback URI you provided when the application was created.
grant_type: required; The string authorization_code in the initial access token request.
code: required; The authorization code received in the previous step, "Requesting the Grant."

Returns

An access token that can be used to access a protected resource; a refresh token that can be used to get another access token upon the expiration of the prior access token.

Parse out the access_token, refresh_token and expires_in values. The access_token is what you must set in HTTP headers when accessing a protected resource; it will expire in expires_in seconds. Once that period has passed, use the refresh_token to get a new access_token.

To this end, to keep from constant re-authorizing, the refresh_token should be persisted somewhere.

POST /oauth/token

curl -X POST \
  -d "client_id={oauth_application_id}" \
  -d "client_secret={oauth_secret}" \
  -d "redirect_uri={oauth_callback}" \
  -d "grant_type=authorization_code" \
  -d "code={authorization_code}" \
  https://api7.ignitermedia.com/oauth/token

{
  "access_token" : "09ba487fc3df...",
  "token_type" : "bearer",
  "expires_in" : 7200,
  "refresh_token" : "8c488ab5f75d61...",
  "scope" : "read products"
}

Using the Access Token

For each request to access a protected resource, you will need to add this HTTP header:

Authorization: Bearer {access_token}

Renewing the Access Token

When the access token expires, you will need to craft a POST request very similar to the one following the authorization grant.

client_id: required; The Client ID received when the application was created.
client_secret: required; The client secret received when the application was created.
redirect_uri: required; The callback URI you provided when the application was created.
grant_type: required; The string refresh_token.
refresh_token: required; The saved refresh token.

Returns

An access token that can be used to access a protected resource; a refresh token that can be used to get another access token upon the expiration of the prior access token. Note changes to the grant_type parameter and the replacement of the code parameter with refresh_token.

POST /oauth/token

curl -X POST \
  -d "client_id={oauth_application_id}" \
  -d "client_secret={oauth_secret}" \
  -d "redirect_uri={oauth_callback}" \
  -d "grant_type=refresh_token" \
  -d "refresh_token={refresh_token}" \
  https://api7.ignitermedia.com/oauth/token

{
  "access_token" : "09ba487fc3df...",
  "token_type" : "bearer",
  "expires_in" : 7200,
  "refresh_token" : "8c488ab5f75d61...",
  "scope" : "read products"
}

User Credentials & Metadata

Get User Info

Retrieves authenticated user information.

Arguments

None.

Required scope

The access token must have been granted the read scope, which is granted by default when scope is omitted. A missing, invalid or expired token returns 401; a token without the read scope returns 403.

Returns

Returns an object with the authenticated user's active membership information.

The active_membership.is_trial attribute is true when the active membership is a trial, and false otherwise.

A user with no active membership is reported with the Freebie plan (named "Free Membership"), and its valid_thru is the date the API request is made. Its active attribute is still true.

GET /v2/me.json

curl -H 'Authorization: Bearer {oauth_token}' \
https://api7.ignitermedia.com/v2/me.json

{
  "id": 3,
  "email": "user@example.org",
  "name": "Example User",
  "created_at": "2006-08-11T02:15:57.699-05:00",
  "updated_at": "2017-01-03T12:17:24.992-06:00",
  "active_membership": {
    "plan_code": "Freebie",
    "plan_name": "Free Membership",
    "plan_description": "No access to member-only content",
    "active": true,
    "is_trial": false,
    "valid_thru": "2017-01-03"
  }
}

Active Membership Metadata

The table below shows you the possible returned plan_* attributes for the active_membership part of the response.

`plan_code`	`plan_name`	`plan_description`
`STARTER`	`Starter`	`All title graphics and backgrounds`
`STANDARD`	`Standard`	`The essential media assets`
`PRO`	`Pro`	`Everything on the site is yours!`
`SCHOLARSHIP`	`Scholarship`	`If you just need the basics.`

Products

Retrieve a product

Retrieves an Igniter Media product and short-lived links to the full-resolution files the authenticated user's membership may download.

Arguments

id: required; The product's ID.

Required scope

The access token must have been granted the products scope, and your application must be registered for it. Request it alongside read, as scope=read products. A missing, invalid or expired token returns 401; a token without the products scope returns 403.

Returns

Returns the product's metadata and a download_contents list with one entry per file the user may download, ordered by id. Project files (PSD and AEP) are never included.

Each download content's product_format_option is main-download for files in the product's main format. Files in an optional format carry a slug of that option's name instead.

When the user's membership does not include the product, the response is still 200, with downloadable set to false and an empty download_contents list.

Download URLs expire after 10 minutes. Re-fetch the product to get fresh URLs when you need them; do not store them.

Responds with 404 and {"error": "not found"} when the product does not exist, is not active, has not been released yet, is a collection, or is not produced by Igniter Media.

GET /v2/products/:id.json

curl -H 'Authorization: Bearer {oauth_token}' \
https://api7.ignitermedia.com/v2/products/50178.json

{
  "id": 50178,
  "name": "Easter Sunday",
  "sub_title": "He Is Risen",
  "short_description": "A bright, hopeful Easter title.",
  "site_product_type": "Stills",
  "media_type": "still",
  "producer": "Igniter Media",
  "fonts_used": "Montserrat, Playfair Display",
  "iso_language": "en",
  "release_date": "2026-03-01T05:00:00Z",
  "updated_at": "2026-03-02T14:11:09Z",
  "url": "https://www.ignitermedia.com/products/50178-easter-sunday",
  "downloadable": true,
  "download_contents": [
    {
      "id": 912345,
      "product_format_id": 61234,
      "product_format_option": "main-download",
      "filetype": "JPEG",
      "resolution": "16:9",
      "upload_type": "title-1",
      "size": 2483021,
      "zipped": false,
      "url": "https://rt-assets-prod.s3.amazonaws.com/downloads/...?X-Amz-Expires=600&...",
      "url_expires_at": "2026-10-07T22:10:00Z"
    }
  ]
}

V2 API Documentation

Authentication & Authorization

Creating an Application

Scopes

Available scopes

Requesting scopes

Requesting the Grant

Arguments

Returns

No, really— what happens?

Getting an Access Token

Returns

Using the Access Token

Renewing the Access Token

Returns

User Credentials & Metadata

Get User Info

Arguments

Required scope

Returns

Products

Retrieve a product

Arguments

Required scope

Returns