Overview
Adminest uses Auth0 for authentication. API requests require a valid JWT bearer token obtained through the Auth0 authentication flow.Getting a Token
For Web Applications
Use the Auth0 SDK to authenticate users and obtain tokens:Auth0 Configuration
| Parameter | Value |
|---|---|
| Domain | auth0.adminest.com |
| Audience | https://adminest-api |
| Scope | openid profile email |
Using the Token
Include the token in theAuthorization header:
Token Structure
The JWT contains:sub- User IDemail- User email addressexp- Token expiration timestampaud- Audience (https://adminest-api)iss- Issuer (https://auth0.adminest.com/)
Token Expiration
Tokens expire after 24 hours. UsegetAccessTokenSilently() to automatically refresh tokens.
Error Responses
401 Unauthorized
- Token is expired
- Token is malformed
- Token was issued for wrong audience
403 Forbidden
- User doesn’t have access to the resource
- Feature not available for user’s plan
Security Best Practices
Never Expose Tokens
Don’t include tokens in URLs or log them
Use HTTPS
Always use HTTPS for API requests
Refresh Tokens
Use token refresh rather than long-lived tokens
Validate on Server
Always validate tokens server-side
