Authentication - Kravata

Kravata assigns a username and password to accepted customers after the onboarding and compliance review. You exchange them for two JWT tokens:

Token	Validity	Use
`access`	5 minutes	Send it as `Authorization: Bearer <access>` in every request.
`refresh`	24 hours	Exchange it for a new `access` token without sending your password again.

Get your tokens

curl -X POST https://testapi.kravata.co/api/token \
  -H "Content-Type: application/json" \
  -d '{ "username": "YOUR_USERNAME", "password": "YOUR_PASSWORD" }'

{
  "refresh": "eyJhbGciOi...",
  "access": "eyJhbGciOi..."
}

Refresh the access token

When the access token expires, request a new one with the refresh token:

curl -X POST https://testapi.kravata.co/api/token/refresh \
  -H "Content-Type: application/json" \
  -d '{ "refresh": "YOUR_REFRESH_TOKEN" }'

{ "access": "eyJhbGciOi..." }

When the refresh token also expires, request a new pair with POST /api/token.

Authenticate your requests

curl https://testapi.kravata.co/api/infoClient \
  -H "Authorization: Bearer YOUR_ACCESS_TOKEN"

Most endpoints also require your clientId, in the path (/api/accounts/{clientId}) or as a query parameter (/api/ramps?clientId=...). Get it from Get Client Info.

Call the API only from your backend. Never expose your password or tokens in a browser or mobile app.