API Reference
Authentication
How to authenticate requests to a TWIN supply-chain node.
Every API call requires a JWT, obtained by logging in. All endpoints accept it either as the access_token session cookie or as an Authorization: Bearer header — both carry the same token. If both are sent, the Bearer header takes precedence.
| Credential | Where it comes from | Typical use |
|---|---|---|
Session cookie (access_token) | Set-Cookie on login | Browsers, the front end |
Authorization: Bearer <jwt> | The same token, read from the cookie | curl, scripts, servers |
POST /authentication/login
Log in to obtain a session cookie.
POST /authentication/login
Content-Type: application/json{
"email": "[email protected]",
"password": "your-password"
}Response 200
The JWT is delivered via Set-Cookie, not the response body.
Set-Cookie: access_token=<jwt>; HttpOnly; Path=/; SameSite=Strict{
"expiry": 1719150000000
}expiry is milliseconds since Unix epoch.
Errors
| Status | Cause |
|---|---|
401 | Wrong email or password |
400 | Missing or malformed field |