MANSOQ IT & integrations
Authenticate API clients and recover from expiry
Use the documented bearer scheme and supported refresh/logout flow.
Current source · source reviewed · 6 min read
Before you begin
- Dedicated authorized account with least-privilege facility access.
- A secure credential store and the current deployment API schema.
1. Use the supported login contract
The URL configuration defines api/v1/auth/login and token/refresh paths. Follow the deployed request/response schema and required account factors rather than embedding a user’s browser session.
2. Send the bearer token
The OpenAPI authentication extension defines Authorization: Bearer with JWT format. Keep tokens out of public examples, query strings and screenshots.
3. Handle expiry and invalidation
The custom JWT validator checks token invalidation and returns an invalid-token response when necessary. Use the supported refresh flow or reauthenticate according to the client contract; stop repeating unauthorized mutations.
4. Verify authorization separately
After authentication, check facility membership and action permission. Reading configuration, importing, publishing, claims, cash and bank confirmation are separate rights.
5. End sessions appropriately
Use the supported logout/invalidation behavior when the client session is ended or revoked. Rotate stored credentials under the deployment owner’s operating procedure.
Non-production schemes
The authentication source explicitly labels Basic and cookie/session schemes as unsuitable for production use. Prefer the supported production bearer contract.
Expiration is configured
Access and refresh lifetimes are environment settings. Do not hard-code an assumed universal lifetime from a default or browser refresh interval.
Troubleshooting
Login succeeds but an action returns forbidden
Inspect facility scope and the specific permission. Refreshing a token cannot create missing claim, publication or treasury authority.
Source evidence
References are pinned to the private MANSOQ source repository. Repository access is required to open these links.