Authentication

SESTEK SR authentication works differently depending on how the service is deployed. Cloud uses a per-request bearer token; On-Premises licenses the host machine once and needs no token at all. Both flows are described below.

Token Generation for SESTEK Cloud SR Service

SESTEK Cloud Speech Recognition (SR) service uses bearer tokens for authentication and authorization. These tokens are required to access API endpoints securely.

When your subscription is created, a Client ID and Client Secret are generated in the SESTEK Portal and sent to you. Use these credentials to generate tokens as described below.

Authentication Endpoint

To obtain an authentication token, send a request to the following endpoint:

Endpoint:

https://identity.ldm.knovvu.com/connect/token

Token Request Process

REST Service Client Actions	REST Service Actions
POST Get Integration Token (SESTEK Portal endpoint)	Generates a bearer token for authentication.
Required Parameters (Body):	`client_id`, `client_secret`, `grant_type=client_credentials`, `scope=Ldm_Integration`
Business Rules:	Subscription must be valid.

The grant_type and scope values above are fixed; do not change them. Only client_id and client_secret are specific to your subscription.

Example Token Request (cURL)

curl --location 'https://identity.ldm.knovvu.com/connect/token' \
--header 'Content-Type: application/x-www-form-urlencoded' \
--data-urlencode 'client_id=[your_client_id]' \
--data-urlencode 'client_secret=[your_client_secret]' \
--data-urlencode 'grant_type=client_credentials' \
--data-urlencode 'scope=Ldm_Integration'

Example Token Response

{
    "access_token": "[your_token]",
    "expires_in": 31536000,
    "token_type": "Bearer",
    "scope": "Ldm_Integration"
}

Token Validity and Expiry

Access tokens issued by the SESTEK Portal are valid for one year (365 days) from the moment of generation.

Once generated, the same token can be used for API requests until it expires.
After one year, the token must be renewed by generating a new one using the same process.
Store the token's expires_in value alongside its generation timestamp, and request a new token before it lapses, so integrations do not fail unexpectedly on expiry.

Troubleshooting

The following responses were confirmed by sending real requests to the endpoint:

Cause	HTTP Status	Response
Invalid `client_id` or `client_secret`	401	`{"error": "invalid_client", "error_description": "The specified 'client_id' is invalid."}`
`grant_type` missing	400	`{"error": "invalid_request", "error_description": "The mandatory 'grant_type' parameter is missing."}`
`grant_type` is not `client_credentials`	400	`{"error": "invalid_request", "error_description": "..."}` (the exact message depends on the grant type attempted)
`client_secret` missing	400	`{"error": "invalid_request", "error_description": "The 'client_secret' or 'client_assertion' parameter must be specified when using the client credentials grant."}`
`scope` value is not `Ldm_Integration`	400	`{"error": "invalid_scope", "error_description": "The specified 'scope' is invalid."}`

If your client_id and client_secret are correct but you still receive invalid_client, confirm your subscription is active, then contact your SESTEK Sales Operations contact.

Licensing for SESTEK On-Premises SR

On-premises deployments of the SR service do not use bearer tokens. Instead, the machine hosting the SR service is licensed once using the License Service application. Once a machine is licensed, its SR API requests do not require an Authorization header at all.

Activating a License

Install the License Service on the machine running the SR service.
A member of SESTEK's Application Support team enters the license key into the License Service application.
Once activation completes, the SR service on that machine is licensed and ready to accept requests.

Using the API After Activation

No Authorization header is required for SR API requests once the machine is licensed. Submit requests directly to your on-premises SR service's endpoint.

Documentation Index