Skip to content
ReplycoReplycoAPI

Authenticate and obtain access tokens

POST
/openapi/auth/token
curl --request POST \
  --url https://open-api.replyco.com/openapi/auth/token \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json-patch+json' \
  --data '{ "grantType": "password", "email": "integration@example.com", "password": "<your-password>" }'

Authenticates a user and returns JWT access token and refresh token. Supports two authentication flows:

1. Password Authentication (grant_type: “password”):

POST /auth/token
{
  "grantType": "password",
  "email": "user@example.com",
  "password": "SecurePassword123!"
}

2. Refresh Token Authentication (grant_type: “refresh_token”):

POST /auth/token
{
  "grantType": "refresh_token",
  "refreshToken": "your-refresh-token-here"
}

Response includes:

  • accessToken: JWT token for API authentication (short-lived)
  • expiresIn: Token expiration timestamp
  • refreshToken: Token for obtaining new access tokens (long-lived)

Token Lifetime:

  • Access Token: Configurable (default: hours)
  • Refresh Token: Configurable (default: 60 days)

Usage:

  • Include the access token in subsequent requests: Authorization: Bearer {accessToken}
  • Use refresh token to obtain new access token before expiration
  • Refresh tokens are single-use and will be rotated

Security Notes:

  • Store tokens securely (never in localStorage for web apps)
  • Tokens are tied to the authenticated user and company
  • Failed authentication attempts may be rate-limited

Authorizations

Section titled “Authorizations”

Request Body

Section titled “Request Body”

Authentication credentials (email/password or refresh token)

object
email

The email address of the registered user account

string
nullable
password

The user’s password for authentication

string
nullable
registrationToken

Registration token from the invitation email sent to new users. Only required for first-time sign-in after invitation. Ignore for existing users

string
nullable
twoFactorAuthenticator

Two-factor authentication method identifier (e.g., “totp”, “sms”). Required if 2FA is enabled for the account

string
nullable
verificationCode

Verification code from the two-factor authentication method. Required if 2FA is enabled for the account

string
nullable
date

The date and time of the authentication attempt. Used for audit logging

string format: date-time
grantType

The OAuth 2.0 grant type. Use “password” for email/password authentication or “refresh_token” to obtain a new access token using a refresh token

string
nullable
refreshToken

The refresh token value obtained from a previous successful authentication. Required when GrantType is “refresh_token”. Should be empty when GrantType is “password”

string
nullable

Example 

{
  "grantType": "password",
  "email": "integration@example.com",
  "password": "<your-password>"
}

Responses

Section titled “Responses”

200

Section titled “200”

Authentication successful, returns tokens

Media typeapplication/json
object
accessToken
string
nullable
refreshToken
string
nullable
expiresIn
string format: date-time
authenticatorToken
string
nullable
auditTrailVisible

Present on admin sign-in: whether this admin can view the audit trail in the console.

boolean
nullable

Example 

{
  "accessToken": "<access-token>",
  "refreshToken": "<refresh-token>",
  "expiresIn": "2026-10-24T09:15:00Z"
}

400

Section titled “400”

Invalid credentials, missing fields, or unsupported grant type

401

Section titled “401”

Authentication failed (wrong password, expired token, etc.)

429

Section titled “429”

Too many authentication attempts, please try again later