Authentication Token & Expiration

API requests to MPS are secured through an authentication system based on login and password, along with the use of a JWT token to protect API access after authentication. Any request sent without proper authentication will be rejected.

🚧

The only endpoint that doesn't need a bearer authorization token (JWT) is the "Login" one in the Authentication category.

This is because this endpoint will return a JWT token, to provide you access to all of the functionalities of the API.

1. Authentication Process

1. Authentication via login and password:

   • Users must first authenticate through the dedicated authentication endpoint (/login) by sending their login and password in a POST request with JSON format.
   • If authentication is successful, a JWT token (JSON Web Token) is returned in the response.
   • This token must then be included in the headers of all subsequent requests to access protected API resources.

2. Using the JWT token for authenticated requests:

   • Once the user receives their JWT token, it must be provided in the HTTP Authorization header for every protected request.
   • The Authorization header must have the following format:

HTTP

Authorization: Bearer <token>

📘

Security Requirements

If a request is sent without the JWT token in the Authorization header, or if the token is invalid or expired, the API will return a 401 Unauthorized error.

2. JWT Token Management

• Token expiration: JWT tokens have a 15 minutes lifespan. Once expired, a new token must be obtained by re-authenticating with credentials via the /login endpoint.
• Confidentiality: The JWT token must be kept secret and secure at all times.