Authentication: Authentication · Innovorder API Documentation

Authentication is handled via OAuth-style bearer tokens. Access tokens are valid for 24 hours (14 days when rememberMe is set to true). When a token expires, the API responds with a 401 error (token_expired): authenticate again via this endpoint to obtain a new token. Tokens should be stored securely.

Login

POST`/oauth/login`Request Access Token

Exchange your credentials for an access token.

Request Body

json

rememberMe=true
username=myEmail@emailProvider.com
password=myPassword
grant_type=password

Request Body Properties

Every field in the example is listed below. Explicit requiredness is shown when the endpoint contract defines it.

Property	Type	Example	Description
rememberMe	boolean	true	The remember me value.
username	string	myEmail@emailProvider.com	The username value.
password	string	myPassword	The password value.
grant_type	string	password	The grant type value.

Response

json

{
  "access_token": "eyJhbGciOiJIUzI1...",
  "status": 201,
  "code": "token_created",
  "message": "You have successfully logged in.",
  "data": {
    "user": {
      "userId": 1,
      "email": "user@example.com",
      "role": "brand",
      "brandId": 100
    }
  },
  "token_type": "Bearer"
}

Response Properties

Every field in the example is listed below. Explicit requiredness is shown when the endpoint contract defines it.

Property	Type	Example	Description
access_token	string	"eyJhbGciOiJIUzI1..."	The access token value.
status	integer	201	HTTP status code returned by the API.
code	string	"token_created"	Machine-readable application code for the result.
message	string	"You have successfully logged in."	Human-readable result message. Do not use this value for program logic.
data	object	{…}	Endpoint-specific response payload.
data.user	object	{…}	Object containing user fields.
data.user.userId	integer	1	Identifier of the user.
data.user.email	string	"user@example.com"	Email address.
data.user.role	string	"brand"	The role value.
data.user.brandId	integer	100	Identifier of the brand.
token_type	string	"Bearer"	The token type value.

Using the Token

Include the token in the Authorization header of subsequent requests:
Authorization: Bearer <token>