POST /auth - User Authentication
Authenticate a user and receive access and refresh tokens.
Endpoint URL
POST /api/auth?api_token=your_api_access_token
Request Headers
Content-Type: application/json
Request Body
{
"username": "user@example.com",
"password": "user_password"
}
Response
Success (200 OK):
{
"status": "success",
"message": "Authentication successful",
"access_token": "eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9...",
"refresh_token": "def50200a1b2c3d4e5f6789...",
"expires_in": 3600,
"token_type": "Bearer"
}
Error (401 Unauthorized):
{
"status": "error",
"message": "Invalid credentials"
}
Example Usage
curl -X POST "https://api.creditrisk.co.za/api/auth?api_token=your_api_token" \
-H "Content-Type: application/json" \
-d '{
"username": "user@example.com",
"password": "password123"
}'
fetch('https://api.creditrisk.co.za/api/auth?api_token=your_api_token', {
method: 'POST',
headers: {
'Content-Type': 'application/json'
},
body: JSON.stringify({
username: 'user@example.com',
password: 'password123'
})
})
.then(response => response.json())
.then(data => {
console.log('Auth success:', data);
localStorage.setItem('access_token', data.access_token);
localStorage.setItem('refresh_token', data.refresh_token);
});
Important Notes
- Always store tokens securely (use secure storage, not local storage for sensitive apps)
- Access tokens expire - use the refresh token to get new ones
- Include the API token in all requests
- Use HTTPS for all API calls