> For clean Markdown of any page, append .md to the page URL.
> For a complete documentation index, see https://docs.revvue.ai/llms.txt.
> For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://docs.revvue.ai/_mcp/server.

# Authentication

Every request to the RevVue API (except the `authorization` and `authorizationSettings` queries themselves) must carry a JWT access token:

```bash
Authorization: Bearer <token>
```

Tokens are issued through the API itself, so sign-in is a plain GraphQL query — no separate auth service to integrate.

## Get a token

Use the `authorization` query with your credentials. Two grant types are supported:

* `PASSWORD` — sign in as a user (optionally with a `totp` code if two-factor is enabled)
* `CLIENT_CREDENTIALS` — machine-to-machine access for integrations and backend services

**`Password grant`**

```graphql title="Password grant"
query SignIn {
  authorization(
    grantType: PASSWORD
    username: "you@example.com"
    password: "••••••••"
  ) {
    user {
      id
      name
      tenantId
      token
    }
  }
}
```

**`Client credentials`**

```graphql title="Client credentials"
query ServiceSignIn {
  authorization(
    grantType: CLIENT_CREDENTIALS
    clientId: "your-client-id"
    password: "••••••••"
  ) {
    user {
      tenantId
      token
    }
  }
}
```

The `user.token` field in the response is your JWT. Send it as the `Authorization: Bearer` header on every subsequent request.

Tokens expire. Decode the JWT (or use the `user.decodedToken` field) to read the expiry, and request a new token before it runs out — the `authorization` query also accepts an existing `token` argument to refresh a session.

## Tenancy

RevVue is multi-tenant: every resource belongs to a **tenant** (your organization), and most queries and mutations take or infer a `tenantId`. Your token is scoped to your tenant — you'll find it on `user.tenantId` after signing in.

If a user belongs to several tenants, the `tenantToken` query issues a token scoped to a specific one:

```graphql
query {
  tenantToken(email: "you@example.com", tenantId: "your-tenant-id") {
    token
  }
}
```

## Verifying tokens

If you need to validate RevVue-issued JWTs in your own services, the `authorizationSettings` query exposes the public key, audience, and realm configuration used to sign them.