API Reference / 01

API Authentication

The Rona ERP API uses JWT (JSON Web Token) authentication for secure access. All endpoints require authentication — except public endpoints like sign-in and password reset.

JWTBEARER24H TOKENS

Authentication flow

Send credentials to POST /auth/sign-in

Receive a JWT token in the response

Include the token in the Authorization header

The token is validated on every request

The token expires after 24 hours by default

Sign-in endpoint

POST /auth/sign-in — request

{
  "email": "user@example.com",
  "password": "your-password"
}

POST /auth/sign-in — response

{
  "success": true,
  "data": {
    "token": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...",
    "user": {
      "id": "user-id",
      "email": "user@example.com",
      "name": "John Doe"
    }
  }
}

Using the token

Authorization header

Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...

Token expiration

Expiration behavior

Default duration	24 hours
Expiration response	401 Unauthorized
Action	Re-authenticate to get a new token

OAuth integration

Rona ERP supports Google OAuth — users can sign in with their Google account.

Redirect to /auth/google/oauth

The user authenticates with Google

Google redirects back with an authorization code

Exchange the code for a JWT token

Return the token to the client

Permission checks

Beyond authentication, the API checks permissions based on the user's roles.

Error responses

401 Unauthorized	Missing or invalid token
403 Forbidden	Valid token but insufficient permissions

Best practices

Store tokens securely (httpOnly cookies recommended)
Validate token expiration before use
Implement a token refresh flow
Use HTTPS for all API calls
Never expose tokens in client-side code
Log out by clearing the token on the client side

Continue

Inventory API

Endpoints for items, stock balances, movements, and every stock operation.

Inventory API

Sign-in endpoint

POST /auth/sign-in — request

{
  "email": "user@example.com",
  "password": "your-password"
}

POST /auth/sign-in — response

{
  "success": true,
  "data": {
    "token": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...",
    "user": {
      "id": "user-id",
      "email": "user@example.com",
      "name": "John Doe"
    }
  }
}