Skip to main content

Customer API Authentication

The Customer API uses JWT Bearer Token authentication for secure access to customer-specific operations.

Overview​

The Customer API is designed for end customers who want to generate and manage their own employee handbooks. All requests require a valid JWT bearer token.

Authentication Method​

Bearer Token (JWT) - Pass in the Authorization header

Using Bearer Token​

curl -X POST https://handbooks.io/api/graphql-public \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer your_bearer_token_here" \
  -d '{"query": "{ listHandbooks { handbooks { handbookId } } }"}'

JavaScript Example​

const response = await fetch('https://handbooks.io/api/graphql-public', {
  method: 'POST',
  headers: {
    'Content-Type': 'application/json',
    'Authorization': 'Bearer your_bearer_token_here',
  },
  body: JSON.stringify({
    query: `
      query {
        listHandbooks {
          handbooks {
            handbookId
            createdAt
          }
        }
      }
    `,
  }),
});

Getting Your Bearer Token​

Bearer tokens are generated by your reseller or administrator using the Reseller API. Contact your reseller or [email protected] to obtain your bearer token.

Token Expiration​

  • Bearer Tokens: Default expiration is 30 days (2,592,000 seconds)
    • Expiration can be customized by your reseller when generating the token
    • Check the expiresAt field in the token response

Security Best Practices​

  1. Never commit tokens to version control
  2. Use environment variables to store tokens
  3. Rotate tokens regularly if possible
  4. Use HTTPS for all API requests
  5. Keep tokens secure - Treat bearer tokens like passwords

Error Responses​

Invalid Token​

{
  "errors": [
    {
      "message": "Invalid token",
      "extensions": {
        "code": "UNAUTHENTICATED"
      }
    }
  ]
}

Missing Token​

{
  "errors": [
    {
      "message": "Unauthorized: Token required",
      "extensions": {
        "code": "UNAUTHENTICATED"
      }
    }
  ]
}

Expired Bearer Token​

{
  "errors": [
    {
      "message": "Token has expired",
      "extensions": {
        "code": "UNAUTHENTICATED"
      }
    }
  ]
}