Authentication

The API uses OAuth 2.0 Bearer tokens by our OAuth 2.0 authorization server (RS256-signed JWTs). Every protected endpoint expects an Authorization: Bearer <bearer-token> header.

Ways to obtain a token

1. Password login — POST /login with a JSON body of email, password and rememberMe. Returns token (a Passport access token) plus the user company context, location count and branding theme. (Login)
2. SSO — JumpCloud (OIDC) — browser flow: Authorize redirect, then JumpCloud, then callback, then GET /auth/sso/exchange redeems the one-time code for a token. (SSO — Review Management login (OAuth 2.0) / SSO — JumpCloud handoff)
3. Discover (optional, pre-login) — POST /auth/discover with an email returns whether that account supports password login, SSO, or both — without revealing whether the email exists (no account enumeration). (Discover auth methods)

Using the token

Send it on every protected call:

Authorization: Bearer <bearer-token>

Protected route groups (all behind the authentication Passport guard):

Account-owner impersonation token

A partner can mint a Passport personal access token issued AS an account owner via POST /partner/account-owner/token (formerly /partner/brand-owner/token). The collection stores it in the impersonation token for requests that must run in the account's own context.

Token lifecycle

• Access tokens and personal access tokens expire 1 day after issue.
• Refresh tokens are valid for 30 days.
• Verify: GET /verify-token (Verify token) echoes the authenticated user when the token is still valid.
• Revoke / logout: GET /logout (Logout) deletes the current token server-side.

Public vs protected

Only a small set of endpoints are public (No Auth): login, email-OTP verify/resend, the signup wizard, auth discovery, SSO redirect/callback/exchange, pre-login branding and reference lookups (plans, feature-options, countries/states/cities, white-label resolver), campaign tracking + QR landing pages, and provider webhooks (Mandrill, Bandwidth, ReviewData — each verified by its own signature or token). Every state-changing (write) endpoint requires a valid OAuth bearer token.

Prerequisites

• A bearer token in the Authorization header. Any endpoint that needs no token says so on its own page.
• The id of each record the call targets. Every endpoint page lists the ids it needs.

Errors

Individual endpoints may return more; each page lists its own.

Sections

Endpoints