Skip to main content

Authentication flow

This section provides the technical specifications and security mechanisms for authenticating with the Koncili API.

The Koncili API uses JWT token-based authentication, with two primary mechanisms:

  1. Access token: Initial credentials
  2. Refresh token: Access renewal

Access Token​

Endpoint:​

  • POST: /public/api/auth/token

Requirements:​

  • Credentials must be base64 encoded.
  • Format: email:password
Important

How to encode your credentials:

  1. Combine email and password in the following format: youremail@domain.com:yourpassword
  2. Convert to base64.

Request example:

  { "credentials": "dGVzdGVAZW1haWwuY29tOnNlbmhhMTIz" }

Refresh token​

Endpoint:​

  • POST: /public/api/auth/refresh-token

Characteristics:​

  • Each renewal generates a new refresh token.
  • The previous token is invalidated after renewal.
Important

The access token is valid for 2 hours. Implement a token update process using the refresh token.