Skip to main content

​
Authentication

The DokStamp API uses JWT Bearer tokens issued by Laravel Passport. Every request to a protected endpoint must include a valid token in the Authorization header.

​
Obtain a token

Send your credentials to POST /auth/login: 
curl -X POST https://api.dokstamp.eu/auth/login \
  -H "Accept: application/json" \
  -H "Content-Type: application/json" \
  -d '{
    "email": "admin@yourschool.edu",
    "password": "your_password"
  }'
Response: 
{
  "access_token": "eyJ0eXAiOiJKV1QiLCJhbGciOiJSUzI1NiJ9...",
  "refresh_token": "def50200a9c4b...",
  "token_type": "Bearer",
  "expires_in": 31536000
}
FieldTypeDescription
access_tokenstringJWT token. Use this in the Authorization header.
refresh_tokenstringUse this to obtain a new token pair when the current one expires.
token_typestringAlways "Bearer".
expires_inintegerValidity in seconds (31 536 000 = 1 year).

​
Use the token

Include the token in every subsequent request: 
Authorization: Bearer eyJ0eXAiOiJKV1QiLCJhbGciOiJSUzI1NiJ9...
Accept: application/json
X-Tenant: your-tenant-identifier
The X-Tenant header is required on all resource endpoints. See Multi-tenancy for details.

​
Refresh a token

Tokens are valid for 1 year. Before expiry — or if a token is revoked — exchange your refresh token for a new pair: 
curl -X POST https://api.dokstamp.eu/auth/refresh \
  -H "Accept: application/json" \
  -H "Content-Type: application/json" \
  -d '{ "refresh_token": "def50200a9c4b..." }'
Returns the same response structure as /auth/login.

​
Logout

Revoke the current access token (server-side blacklist): 
curl -X POST https://api.dokstamp.eu/auth/logout \
  -H "Authorization: Bearer {your_token}" \
  -H "Accept: application/json"

{ "message": "Successfully logged out" }

​
Public endpoints

A small number of endpoints do not require authentication:
EndpointPurpose
POST /auth/loginObtain tokens
POST /auth/refreshRefresh tokens
GET /files/{file}/downloadDownload a signed document by UUID

​
Security recommendations

  • Store tokens in environment variables or secrets managers — never hard-code them.
  • Rotate tokens if a compromise is suspected by calling POST /auth/logout and re-authenticating.
  • Each API user should have their own credentials; avoid sharing tokens between systems.