Authentication

We use JWT for the authentication of the API.

Log In

To obtain a token you need to send a request to /v1/login

Request

POST /v1/login HTTP/1.1
Content-Type: application/json

{
  "email": "<email_here>",
  "password": "<password_here>"
}

Response

{
    "success": true,
    "data": {
        "type": "token",
        "access_token": "<token_goes_here>",
        "expires_in": 3600
    }
}

The token must be supplied in any requests to the API in the Authorization header like so

Authorisation: Bearer <token_goes_here>

Errors

If the supplied credentials are incorrect the following error response will be returned:

{
    "message": "'Invalid credentials"
}

Refresh the Token

Sending a authorised request to the /v1/token endpoint will blacklist the token and return a new token with updated iat (issued at) and nbf (not before) values, extending the length of time a user can remain logged in.

The response will be as follows:

{
    "success": true,
    "data": {
        "type": "refresh_token",
        "access_token": "<token_goes_here>",
        "token_type": "Bearer",
        "expires_in": 3600
    }
}

Log Out

Sending an authenticated request to the /v1/logout endpoint will blacklist the supplied token.

OAuth 2.0 - Client id + Client Secret

To obtain a token using a client_id and client_secret you need to send a request to /oauth/token These tokens are short lived and expire after 15 minutes.

Request

POST /oauth/token HTTP/1.1
Content-Type: application/x-www-form-urlencoded
Accept: application/json

{
  "grant_type": "client_credentials",
  "scope": "red-marker-review",
  "client_id": "<client_id>",
  "client_secret": "<client_secret>",
}

Response

{
    "success": true,
    "data": {
        "type": "token",
        "access_token": "<token_goes_here>",
        "expires_in": 900
    }
}

Refresh the Token

There is no refresh endpoint for these short lived tokens. To obtain a new token, send a request /oauth/token using the above parameters.

Log Out

Sending an authenticated request to the /v1/logout endpoint will blacklist the supplied token.