Authentication

Authentication

The API accepts two methods. A personal API token suits scripts and integrations; a JWT suits apps where a person signs in with email and password.

Personal API token

1. Open API & Integration.
2. Click Generate API token.
3. Copy the token and send it in the Authorization header of every request:

curl -H "Authorization: Token YOUR_TOKEN" https://votre-nom.altiusforms.com/api/v1/forms/

The token acts on your behalf, with your permissions: keep it secret. Rotate token creates a new one and invalidates the old one immediately; Revoke token deletes it. Either way, integrations using the old token stop working until they are updated.

JWT: email and password

1. Request a token pair:

curl -X POST https://votre-nom.altiusforms.com/api/v1/token/ -H "Content-Type: application/json" -d '{"email": "you@example.ch", "password": "..."}'

1. The response contains access (short-lived) and refresh. Send the first one as Authorization: Bearer <access>.
2. When access expires, get a new one:

curl -X POST https://votre-nom.altiusforms.com/api/v1/token/refresh/ -H "Content-Type: application/json" -d '{"refresh": "<refresh>"}'

1. To sign out, invalidate the refresh token:

curl -X POST https://votre-nom.altiusforms.com/api/v1/token/blacklist/ -H "Content-Type: application/json" -d '{"refresh": "<refresh>"}'

Good practice

• Create a dedicated account for each integration, with a role limited to what it needs.
• Never put a token in the code of a public web page.