Skip to main content
JWT is the recommended authentication method for all Avalex API integrations. You exchange your username and password for a signed token once, then include that token on every subsequent request — no password is transmitted again. Tokens are valid for seven days, after which you simply log in again to receive a fresh one.

​
How to Authenticate with JWT

1

Call POST /auth/login with your credentials

Send your username and password as a JSON body to the login endpoint.
A successful response returns a token and a summary of your account:
If your credentials are incorrect, the API returns a 401:
2

Extract the token from the response

Copy the value of the token field from the response body. This is the JWT you will include in all subsequent requests.
3

Include the token in protected requests

Pass the token in the Authorization header as a Bearer token:
4

Re-authenticate after 7 days

Tokens expire after 7 days. When your token expires, repeat the login call to receive a new one.

​
Confirming Your Identity with GET /me

After logging in, you can verify which permissions your token carries by calling GET /me. This is useful for debugging access issues before making other calls.
The response returns your account details and the full list of permissions associated with your token:
Call GET /me immediately after login to confirm your permissions before making other API calls. This saves time when diagnosing unexpected 403 responses.

​
Token Expiry and Renewal

JWT tokens are valid for 7 days from the time they are issued. There is no refresh endpoint — when your token expires, call POST /auth/login again with your credentials to receive a new one. Your application should handle 401 responses by re-authenticating and retrying the original request.
Store tokens securely. Do not log them, include them in URLs, or expose them in client-side code. Anyone who obtains your token can make API calls with your full permissions until it expires.