Authentication

Authentication uses a JWT access token and a refresh token, both delivered as cookies by the login call:

Cookie	Content	Lifetime	Flags
`BEARER`	JWT access token	1 hour	`HttpOnly`, `Secure`, `SameSite=None`
`refresh_token`	Refresh token (single use)	30 days, extended each time it is used	`HttpOnly`, `Secure`, `SameSite=None`

The tokens are not in the response body.

Sending the tokens

Cookie store (recommended)
Authorization header

Store the cookies from every response and send them back on every request. On Android with OkHttp, use a persistent CookieJar (for example PersistentCookieJar).The refresh call needs the refresh_token cookie, so a cookie store is the simplest option.

curl -c cookies.txt -b cookies.txt \
  -H "Content-Type: application/json" \
  -d '{"action":"get_credit"}' \
  https://apitest.tunimobile.com/v1/user/do_action

For the access token only: read the JWT from the Set-Cookie: BEARER=... header of the login response and send it as a bearer token.

curl -H "Authorization: Bearer <jwt>" \
  -H "Content-Type: application/json" \
  -d '{"action":"get_credit"}' \
  https://apitest.tunimobile.com/v1/user/do_action

Expired tokens

When the access token expires, any call that carries it returns:

401

{ "code": 401, "message": "Expired JWT Token" }

Refresh

Call Refresh the session.

Retry once

Retry the original request once.

Fall back to login

If the refresh also fails, send the user back to the login screen.

This also applies to the voucher and session calls: a valid api-key does not help if the request carries an expired token. Either refresh first, or don’t send the cookie on calls that only need the API key.

If several requests fail with 401 at the same time, refresh once and retry them all after it completes. The refresh token is single use, so two parallel refresh calls would make the second one fail.

Getting Started

Basics

Account

Terminal

Vouchers

Sales sessions

Reference

Authentication

Sending the tokens

Expired tokens

​Sending the tokens

​Expired tokens

Sending the tokens

Expired tokens