The Admin API requires a JWT authentication token.

The token can be retrieved with a POST request to the endpoint /admin-api/auth/login by supplying the email and password parameters:

TOKEN=$(curl \
  --request POST \
  --silent \
  --header 'Accept: application/json' \
  --header 'Content-Type: application/json' \
  --data '{"email":"tonystark@stark.example.com","password":"ironman"}' \
  https://demo.mightytix.com/admin-api/auth/login | jq -r '.accessToken')

The returned token can then be used as an authorization header for subsequent requests:

curl \
  --silent \
  --header "authorization: Bearer ${TOKEN}" \
  --header 'Content-Type: application/json' \
  --data '{"query":"query {\n ticketTypes{\n edges{\n node{\n id\n name\n}\n}}\n}\n"}' \
  https://demo.mightytix.com/admin-api/graphql

The authorization token will expire after five minutes. To refresh it, use the refresh token sent as a cookie in response to the login endpoint:

curl \
  --include \
  --request POST \
  --silent \
  --header 'Accept: application/json' \
  --header 'Content-Type: application/json' \
  --data '{"email":"tonystark@stark.example.com","password":"ironman"}' \
  https://demo.mightytix.com/admin-api/auth/login | grep ^set-cookie

set-cookie: refreshToken=eyJhbG...QFzQQ; Path=/admin-api/auth/refresh; HttpOnly; Secure

Then make a request to the endpoint /admin-api/auth/refresh and include the same cookie:

curl \
  --cookie "refreshToken=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJyZWZyZXNoVG9rZW4iOiJVSFRuakVIZ3k2MExZUlFZdm9WNnVXQzJLME5jWGExTSIsInN1YiI6IjZiYWM3NjZhLWEzZGUtNDMzMi05ZWViLWZmZWMxNGEzMTczNCIsInBlcnNpc3QiOmZhbHNlLCJpYXQiOjE2NTYxNDM4MzQsImV4cCI6MTY1ODczNTgzNH0.AZBdse5n5GOOgpeBFT_YDsT8ynh341Q_HohnB1Ye9-A" \
  https://demo.mightytix.com/admin-api/auth/refresh

A refresh token can be used only once. The response to the refresh request will include a new refreshToken cookie, which must be used for the next refresh.

By default the refresh token cookie has no expiry, so browsers will discard it when a session is finished. To request a persistent cookie that will expire after one month, provide a persist parameter of true when logging in:

curl \
  --include \
  --request POST \
  --silent \
  --header 'Accept: application/json' \
  --header 'Content-Type: application/json' \
  --data '{"email":"tonystark@stark.example.com","password":"ironman","persist":true}' \
  https://demo.mightytix.com/admin-api/auth/login | grep ^set-cookie

set-cookie: refreshToken=eyJhbG...QFzQQ; Path=/admin-api/auth/refresh; Expires=Sun, 1 Jan 2023 00:00:00 GMT; HttpOnly; Secure