Authentication

Get a token

POST /Login exchanges your account credentials for one token per database the account can reach.

Request

{ "email": "user@example.com", "password": "your-password" }

Response (trimmed)

[
  {
    "Key": { "Description": "OK", "StatusNumber": 0 },
    "Value": [
      {
        "DataBase": {
          "Id": 82,
          "Name": "eidb_mecanica",
          "GB": 2,
          "Owner": false
        },
        "Token": "cCb3o0OaDLrYGhHY0UMDY8Fd2nmys3RCaRJ2T7Ua7+0g=="
      }
    ]
  }
]

Each entry pairs a database with the token that authorises calls against that database. If the account reaches more than one, pick the one you want and keep its token.

Use the token

The token is not a header

It travels as a Token field inside the JSON body of every call:

{ "idcompany": 1, "Token": "cCb3o0OaDLrYGhHY0UMDY8Fd2nmys3RCaRJ2T7Ua7+0g==" }

An Authorization header will be ignored.

Lifetime

The session expires after 24 hours without activity. Activity refreshes it, so a client polling regularly will not be logged out; one that runs a nightly job will need to log in each time.

There is no refresh endpoint — call Login again.

Handling expiry

A rejected token surfaces in the response envelope, not the HTTP status. Treat a non-zero Key.StatusNumber as a signal to re-authenticate once and retry.

Keeping credentials safe

• The account password buys access to every database that account can reach. Use a dedicated integration account with only what it needs.
• Store credentials outside your source tree.
• Log tokens at your peril: a leaked token is valid until it goes idle for 24 hours, and there is no way to revoke it early.