Server-side implementation of an asset showcase on a website, portal, or application: OAuth 2 authentication, content retrieval, filters, and file distribution.

What you need before you begin

Make sure you have all credentials before starting. Some are provided by the THRON team, others are obtained from the Content Manager who administers the platform.

How to request the user from the Content Manager

To access folder content via API, THRON verifies that the user you operate with has rights on that folder. You cannot use only app credentials: you need a real THRON user to impersonate in calls, via User Impersonation.

Ask the Content Manager to:

1. Create a dedicated THRON user for the integration (e.g. api-website or integration-[project-name])

2. Assign them read rights on the folder you want to expose

3. Provide you with the username; you do not need the password

## Additional articles
- 
Configure Groups and Users, guide for the Content Manager on how to create the user and assign folder rights

How to request application credentials

Once you have the username of the dedicated user, contact support@thron.com to request client_id and client_secret. Include all the information below: a complete request is processed without requiring clarification.

• Application name: a name that identifies the integration, for example Company website.

• Service code: your THRON clientId, for example acme.

• Application usage: server-side, i.e. a server-to-server integration as described in this guide. If instead your integration involves users logging in with their own THRON credentials, specify this in the request: it is a different use case not covered by this guide.

• Roles and permissions: describe what the application needs to do and for what purpose, for example reading assets in a folder to display them on the website, or writing product data from an external system. Based on this, support activates only strictly necessary permissions: this is a security measure.

• Flows to enable: Client Credentials and User Impersonation. User Impersonation is required to access folders and content.

• User to impersonate: the username received from the Content Manager.

Authentication

THRON uses OAuth 2. To access content and folders, which check access permissions via ACLs, User Impersonation is required: the system authenticates with app credentials but operates with the rights of the dedicated user who has folder access.

Recommended flow: User Impersonation

Use this flow whenever you need to access specific content or folders.

POST /api/v1/authentication/oauth2/token HTTP/1.1
Host: {clientId}.thron.com
Content-Type: application/x-www-form-urlencoded

grant_type=urn:thron:oauth:user-impersonation
&scope=
&client_id={client_id}
&client_secret={client_secret}
&subject={username}

In response you receive access_token and refresh_token. The token lasts 8 hours (expires_in: 28800).

Alternative flow: Client Credentials

Use this flow only for operations that do not require access to specific content or folders. Without User Impersonation the token has no folder ACLs and will not return content.

POST /api/v1/authentication/oauth2/token HTTP/1.1
Host: {clientId}.thron.com
Content-Type: application/x-www-form-urlencoded

grant_type=client_credentials
&scope=
&client_id={client_id}
&client_secret={client_secret}

Renew the token

When the access token expires (response 403 Session Expired), use the refresh token to obtain a new one without repeating the full authentication flow.

POST /api/v1/authentication/oauth2/token HTTP/1.1
Host: {clientId}.thron.com
Content-Type: application/x-www-form-urlencoded

grant_type=refresh_token
&refresh_token={refresh_token}
&client_id={client_id}

In response you receive a new access_token and a new refresh_token. The previous one is no longer valid.

## Additional articles
- 
THRON API Documentation, "Authentication" section for complete endpoint reference

Access token and XTokenID: when to use which

Newer THRON APIs use the access token in the Authorization header:

Authorization: Bearer {access_token}

Some legacy APIs still require the XTokenID token in the X-TokenID header. To obtain it from the access token:

GET /api/v1/authentication/token/legacy HTTP/1.1
Host: {clientId}.thron.com
Authorization: Bearer {access_token}

Response:

{ "token": "e1aff403-6583-40f1-961c-f91458aa2112" }

Use the returned value by adding the X-TokenID: {token} header to calls that require it.

## Additional articles
- 
THRON API Documentation, each endpoint indicates the supported token type

Asset search and filters

To retrieve folder assets, use the search APIs documented on the official portal. Calls must be performed with the token obtained via User Impersonation: only then will the system return content that the impersonated user has access to.

If a filter attribute is configured in the platform (select or multiselect), the typical flow is:

1. Retrieve available attribute values, then use them to build filters in the interface

2. Execute asset search applying the value selected by the user

## Additional articles
- 
THRON API Documentation, "Content Search" section for parameters, filters, and pagination

Asset distribution on the channel

You have two ways to display an asset on the external channel: compose the delivery URL and manage markup yourself, or delegate rendering to the THRON Player.

Asset delivery via API

Each asset is reachable via a delivery URL served by the THRON CDN. Insert it wherever you need in your markup: in an img tag, in the browser's native player, in a third-party player, or in a download link.

Use this method when you have full control over the interface and want to decide how content is rendered.

https://{clientId}-cdn.thron.com/api/v1/content-delivery/shares/{pKey}/contents/{contentId}/image/{dynamicSeoSuffix}?w=800&crop=auto

URL segments:

On images you can add query parameters to achieve on-the-fly rendering without generating variants in the platform: dimensions (w, h), crop mode (crop), quality (q), and browser cache duration (maxAge).

## Additional articles
- 
AI MediaBoost image editing: what it does and how to use it, full list of image manipulation parameters
- 
Embedding a Digital Asset into an external website or web page, how to obtain URLs and pKey from the platform
- 
THRON API Documentation, "Content Delivery" section for routes available for each asset type

THRON Player

Alternatively, delegate rendering to the THRON Player, which automatically manages formats, responsiveness, accessibility, playback controls, and the Content Experience configured in the platform. The platform generates the embed code: you don't need to write it manually.

Use this method when you want the same playback experience already in use on other channels, or when delivering video and you don't want to handle quality adaptation and controls yourself.

## Additional articles
- 
Embedding a Digital Asset into an external website or web page, how to generate and customize embed code
- 
THRON Player: accessibility, interface, and templates, template versions and CEM compatibility

Recommended configuration

Need help?

For technical issues, write to support@thron.com.