Skip to main content

Authentication

The API uses JWT (JSON Web Token) for authentication. All endpoints (except login) require a valid token.

Login​

POST /api/auth/login

Credentials are sent in headers, not in the body.

Required Headers​

HeaderDescriptionExample
X-UsernameAPI usernamemy_user
X-PasswordPasswordmy_password

cURL Example​

curl -X POST "https://ws-api.masaprisaoperativo.com/api/auth/login" \
  -H "X-Username: my_user" \
  -H "X-Password: my_password"

Successful Response​

{
  "response": "OK",
  "message": "Autenticacion exitosa",
  "token": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...",
  "expiresAt": "2026-07-05T12:30:00Z",
  "username": "my_user",
  "email": "user@email.com"
}

Error Response​

{
  "response": "ERROR",
  "message": "Usuario o contrasena incorrectos"
}

Using the Token​

Include the token in the Authorization header of all requests:

Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...

Example​

curl -X GET "https://ws-api.masaprisaoperativo.com/api/sucursales" \
  -H "Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9..."

Validate Token​

You can verify if your token is still valid:

GET /api/auth/validate

Response​

{
  "response": "OK",
  "message": "Token valido",
  "username": "my_user",
  "email": "user@email.com"
}

Expiration​

  • Tokens have configurable expiration (default 24 hours)
  • The expiresAt field indicates when it expires
  • When expired, request a new token via login

:::tip Best Practice Store the token and reuse it until it expires. Don't login on every request. :::