Authentication
NexArc authenticates requests with JSON Web Tokens. Access tokens are short-lived; refresh tokens are long-lived.
Tokens
- —Access token — short-lived, sent on every request.
- —Refresh token — long-lived, used to mint a new access token.
How to send a token
Send the access token either as a bearer header or via the httpOnly cookie set at login:
Authorization: Bearer <access_token>
Signed with RS256
Tokens are signed using RS256 (an asymmetric key pair) in production. The private key signs; the public key verifies. You never need the private key to use the API — just send your issued access token.
Refreshing
When an access token expires you'll get a 401 (AUTH_001). Use your refresh token to obtain a new access token, or simply log in again.
Last updated: June 2026 · Suggest an edit