Authentication

Logging in

Exchange credentials for tokens at the login endpoint. Note the request body uses snake_case:

POST /api/v1/auth/login
Content-Type: application/json

{
  "email": "you@company.com",
  "password": "your-password"
}

A successful response returns an access token and a refresh token.

Making authenticated requests

Send the access token as a Bearer token in the Authorization header:

GET /api/v1/crm/leads
Authorization: Bearer <access_token>

Token lifetimes

• Access token — short-lived (about 15 minutes). Use it on every request.
• Refresh token — longer-lived (about 7 days). Use it only to get a new access token.

Refreshing a token

When the access token expires, exchange your refresh token for a new one:

POST /api/v1/auth/refresh
Content-Type: application/json

{
  "refresh_token": "<refresh_token>"
}

For security, the old refresh token is rotated out. Logging out via POST /api/v1/auth/logout revokes the refresh token immediately.