Skip to main content
Every protected Avalex API endpoint requires valid credentials on each request. You include those credentials in the Authorization header — either as a short-lived JWT Bearer token or as a Base64-encoded username and password. A small set of public endpoints (such as license validation and login itself) do not require any credentials and can be called freely.

​
Authentication Methods

Avalex supports two authentication methods. JWT Bearer tokens are recommended for all real integrations; HTTP Basic Auth is available as a fallback for quick testing.

​
Public Endpoints

The following endpoints do not require authentication and can be called without an Authorization header:
  • POST /auth/login — obtain a JWT token
  • POST /staff/login — staff-specific login alias
  • POST /staff/register — create a new staff account
  • POST /licenses/validate — validate a license key
The Master Admin account always has full access to every endpoint regardless of which authentication method is used.

​
Next Steps

Choose the authentication method that fits your use case and follow the dedicated guide to get started.

JWT Authentication

Obtain a token via POST /auth/login and include it as a Bearer token on every protected call. Recommended for all production integrations.

HTTP Basic Auth

Encode your username and password in Base64 and pass them directly in the Authorization header. Best for quick testing with curl.