Get started

Authentication

Exchange your credentials for a JWT and send it as a bearer token.
View as Markdown

Every request to the RevVue API (except the authorization and authorizationSettings queries themselves) must carry a JWT access token:

Authorization: Bearer <token>

Tokens are issued through the API itself, so sign-in is a plain GraphQL query — no separate auth service to integrate.

Get a token

Use the authorization query with your credentials. Two grant types are supported:

  • PASSWORD — sign in as a user (optionally with a totp code if two-factor is enabled)
  • CLIENT_CREDENTIALS — machine-to-machine access for integrations and backend services
query SignIn {
  authorization(
    grantType: PASSWORD
    username: "you@example.com"
    password: "••••••••"
  ) {
    user {
      id
      name
      tenantId
      token
    }
  }
}

The user.token field in the response is your JWT. Send it as the Authorization: Bearer header on every subsequent request.

Tokens expire. Decode the JWT (or use the user.decodedToken field) to read the expiry, and request a new token before it runs out — the authorization query also accepts an existing token argument to refresh a session.

Tenancy

RevVue is multi-tenant: every resource belongs to a tenant (your organization), and most queries and mutations take or infer a tenantId. Your token is scoped to your tenant — you’ll find it on user.tenantId after signing in.

If a user belongs to several tenants, the tenantToken query issues a token scoped to a specific one:

query {
  tenantToken(email: "you@example.com", tenantId: "your-tenant-id") {
    token
  }
}

Verifying tokens

If you need to validate RevVue-issued JWTs in your own services, the authorizationSettings query exposes the public key, audience, and realm configuration used to sign them.