Authentication

The IPCom API uses JWT (JSON Web Token) authentication. You need to first login to obtain a JWT token, then include it in the Authorization header of every request.

Getting Your JWT Token

To obtain a JWT token, use the login endpoint:

curl -X POST "http://your-server-ip:port/api/login" \
     -H "Content-Type: application/json" \
     -d '{
       "username": "your_username",
       "password": "your_password",
       "api_key": ""
     }'

Response:

{
  "token": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...",
  "name": "Your Display Name"
}

For detailed information about the login process, see the Login API documentation.

WARNING

Keep your API token secure! Never share it publicly or commit it to version control.

Using Your JWT Token

Include your JWT token in the Authorization header:

curl -X GET "http://your-server-ip:port/api/users" \
     -H "Authorization: Bearer YOUR_JWT_TOKEN"

JWT Token Claims

JWT tokens contain claims that determine what actions they can perform:

Claim	Description
username	The authenticated user's username
scopes	Array of permissions/scopes for the user

Token Expiration

• JWT tokens have an expiration time that can be configured per user
• Each user can have a different token lifetime based on their role and security requirements
• You'll need to re-authenticate when tokens expire
• Expired tokens will return a 401 Unauthorized response

📖 Configuration: Token expiration times are set in the token_time field (in minutes) for each user. See the Users Management Configuration for details on configuring user-specific token lifetimes.

Error Responses

Authentication errors return specific status codes with plain text messages:

400 Bad Request

Missing required fields

LOG_ON_DATA_INCOMPLETE

401 Unauthorized

Invalid credentials

FAIL

403 Forbidden

API key used but feature not licensed

API feature not licensed