> For the complete documentation index, see [llms.txt](https://elyssa-app.gitbook.io/api-docs/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://elyssa-app.gitbook.io/api-docs/authentication.md).

# Authentication

To authenticate on each endpoint is very simple. Just insert you token on the "Authorization" header and x-company-id

**Example**

```
  'headers': {
    'Content-Type': 'application/json',
    'Authorization': 'Bearer c7f35c84-7893-4087-b4fb-d1f06c23',
    'x-company-id': '<company_id>'
  },
```

## **Get authorization token**

This endpoint is used to authenticate the company. Upon successful execution, it returns a status code of `200` along with a token in the response body.

### Create token

<mark style="color:green;">`POST`</mark> `{{url_base}}/auth/token`

This endpoint is used to authenticate company on Elyssa App and return token to use API. The token it's validate for one month after created token, after that time, you need use refresh token to generate a new token. \
\
If the company does't have an active plan in ElyssaApp, both the token and refresh token will remain inactive.

{% hint style="warning" %}
The Token is valid for one month after its creation.
{% endhint %}

{% hint style="info" %}
The refresh token it's validate for 360 days.
{% endhint %}

#### Request Body

| Name                                        | Type   |
| ------------------------------------------- | ------ |
| companyId<mark style="color:red;">\*</mark> | String |
| nit<mark style="color:red;">\*</mark>       | String |

{% tabs %}
{% tab title="200: OK Authentication token" %}

```json
{
  "data": {
    "accessToken": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJjb22wYW55SWQiOiJiOTRlNDA2Ny0yN2M4LTRhMTQtOGMxZS1jNzAxMzNjYzczYzUiLCJjb21wYW55TmFtZSI6IkVseXNzYSBBcHAgLSBUZXN0IGNvbXBhbnkiLCJleHAiOjE3ODg4MDA2MTYsImlzcyI6IkJhY2tPZmZpY2VFbHlzc2EiLCJhdWQiOiJFbHlzc2FBcHAifQ.7AZLYbhl0nrb7TJ6LNYcX0COWSUgkm486Pk52Yf__-M",
    "refreshToken": "0xTnrH8STws+4hyF4OGJbJsNBLfZDhCocvWm0UTKrjQ4zxVSyyhoxdxLiRBtTAkUQde4eQwPbYaJg/rGg6mSdg==",
    "expiresIn": 2592000,
    "tokenType": "Bearer"
  },
  "success": true,
  "timestamp": "2026-08-08T17:03:37.5560238Z"
}
```

{% endtab %}

{% tab title="401: Unauthorized " %}

```json
{
  "success": false,
  "error": {
    "code": "string",
    "message": "string",
    "details": "string",
    "field": "string"
  },
  "timestamp": "2026-08-08T17:48:17.748Z"
}
```

{% endtab %}
{% endtabs %}

{% hint style="info" %}
If you try to access any endpoint **without entering the "Authorization" header**, or enter an invalid api\_token, you will receive a response with **status 401 (Unauthorized).**
{% endhint %}

### Refresh Token&#x20;

<mark style="color:green;">`POST`</mark> `{{url_base}}/auth/refresh`

This endpoint is used to authenticate and generate a new token

#### Request Body

| Name                                      | Type   |
| ----------------------------------------- | ------ |
| refresh<mark style="color:red;">\*</mark> | String |

{% tabs %}
{% tab title="200: OK Authentication token" %}

```json
{
  "data": {
    "accessToken": "eyJhbGciOiJIUzI1NiIsInR5cCI8IkpXVCJ9.eyJjb22wYW55SWQiOiJiOTRlNDA2Ny0yN2M4LTRhMTQtOGMxZS1jNzAxMzNjYzczYzUiLCJjb21wYW55TmFtZSI6IkVseXNzYSBBcHAgLSBUZXN0IGNvbXBhbnkiLCJleHAiOjE3ODg4MDA2MTYsImlzcyI6IkJhY2tPZmZpY2VFbHlzc2EiLCJhdWQiOiJFbHlzc2FBcHAifQ.7AZLYbhl0nrb7TJ6LNYcX0COWSUgkm486Pk52Yf__-M",
    "refreshToken": "0xTnrH8STws+4hyF4OGJbJsNBLfZDhCocvWm0UTKrjQ4zxVSyyhoxdxLiRBtTAkUQde4eQwPbYaJg/rGg6mSdg==",
    "expiresIn": 2592000,
    "tokenType": "Bearer"
  },
  "success": true,
  "timestamp": "2026-08-08T17:03:37.5560238Z"
}
```

{% endtab %}

{% tab title="401: Unauthorized " %}

```json
{
  "success": false,
  "error": {
    "code": "string",
    "message": "string",
    "details": "string",
    "field": "string"
  },
  "timestamp": "2026-08-08T17:48:17.748Z"
}
```

{% endtab %}
{% endtabs %}