Authentication

Authentication to the Ampere API is required for all endpoints (unless explicitly marked as public).

⚠️
Important: Always use HTTPS to protect credentials in transit.

Clients must include an Authorization header with a bearer token.

Authorization: Bearer <accessToken>

Ampere authenticates partners with short-lived JWT access tokens. There is no API-key authentication on the HTTP API.

Base path: /api/v2/auth

What we provide

Method	Path	Auth required	Purpose
`POST`	`/login`	No	Exchange email + password for access and refresh tokens
`POST`	`/refresh`	No (refresh token in body)	Rotate the token pair
`GET`	`/me`	Bearer access token	Return the authenticated user profile and role
`POST`	`/logout`	Bearer access token	Revoke the current access token and clear the refresh credential

Property	Value
Transport	`Authorization: Bearer <accessToken>`
Access token lifetime	30 minutes
Refresh token lifetime	7 days
Refresh transport	JSON body field `refreshToken` (not the Authorization header)

Access tokens are validated on every protected request.
Refresh tokens are rotated: a successful refresh issues a new pair and invalidates the previous refresh credential.
Logout blacklists the access token for the remainder of its lifetime and clears the stored refresh credential.
Inactive accounts cannot authenticate.
A refresh token cannot be used as an access token.

Call POST /auth/login once to obtain credentials.
Attach the access token to all protected requests.
Call POST /auth/refresh before access-token expiry (or on 401 after a failed protected call).
Call POST /auth/logout when ending a session deliberately.
Keep refresh tokens in a secure store; do not log tokens in plaintext.