Guides

Authentication

How to authenticate against the Inspow API with a JWT Bearer token or an API Key.

The Inspow API accepts two credentials:

A User’s JWT token (Bearer scheme), obtained with their email and password.
An API Key from your Organization, for server-to-server integrations (see API Keys).

1. Get a token

Send the credentials to the login endpoint. If the email exists in several organizations, specify which one with tenantSlug:

curl -X POST https://api.inspow.tech/api/v1/access-control/auth/login \
  -H "Content-Type: application/json" \
  -d '{ "email": "you@example.com", "password": "••••••••", "tenantSlug": "my-organization" }'

Like every API response, it comes wrapped in { "data": …, "meta": … }. The token is in data.token (together with the User’s details in data.user).

If the User has two-step verification

If the account has 2FA enabled, the login does not return token, but requires2fa: true and a tempToken (valid for about 5 minutes). Complete it with the code from the authenticator app:

curl -X POST https://api.inspow.tech/api/v1/access-control/auth/2fa/verify \
  -H "Content-Type: application/json" \
  -d '{ "tempToken": "<TEMP_TOKEN>", "code": "123456" }'

To use a backup code, also send "isBackupCode": true. For automated integrations, use an API Key instead.

2. Use the token

Include the token in the Authorization header of every protected request:

curl https://api.inspow.tech/api/v1/access-control/auth/user/me \
  -H "Authorization: Bearer <YOUR_TOKEN>"

API Keys

For server-to-server integrations, use an API Key from your Organization, with a limited scope, instead of a User’s token. It is sent in X-API-Key: ak_… or in Authorization: Bearer ak_… / Authorization: ApiKey ak_…. See API Keys.