​
Quickstart

This guide gets you authenticated and making your first call.

​
1. Obtain credentials

In MVP we don’t offer public API keys. Mobile clients authenticate the end user via the auth endpoints; integrations should email support@swappr.co.uk.

​
2. Log in

curl -X POST https://api.swappr.co.uk/api/v1/auth/login \
  -H "Content-Type: application/json" \
  -d '{
    "email": "alice@example.com",
    "password": "correct horse battery staple"
  }'
Response: 
{
  "accessToken": "eyJhbGciOiJSUzI1NiIs...",  // RS256 JWT, 15-min TTL
  "refreshToken": "v8q3..._opaque",          // 256-bit, 30-day TTL, single-use
  "user": {
    "id": "usr_01HZQ7K3M4N5P6Q7R8S9T0V1W2",
    "email": "alice@example.com",
    "onboardingStatus": "COMPLETE"           // enum: "IN_PROGRESS" | "COMPLETE"
  }
}

​
3. Make an authenticated call

curl https://api.swappr.co.uk/api/v1/users/me \
  -H "Authorization: Bearer eyJhbGciOiJSUzI1NiIs..."

​
4. Refresh the token when it expires

When /users/me returns 401 UNAUTHENTICATED because the access token expired, call /auth/refresh with the refresh token to get a fresh pair. The old refresh token becomes invalid (single-use rotation).

​
What’s next

  • Read the Authentication page to understand the full token lifecycle, socket tickets, and the OAuth flows.
  • Read the Error conventions before you write client-side error handling.