Authentication and Tokens

Credential lifecycle

Resetting the App Secret or disabling the application immediately revokes all active tokens for that application.

Issue tokens

This endpoint does not require an Access Token. Send a JSON body:

Request body

Request example

curl --request POST "https://backend.biotech-mkt.com/openapi/auth/token" \
  --header "Content-Type: application/json" \
  --data '{"app_key":"ak_xxx","app_secret":"sk_xxx"}'

Response example

{
  "code": 200,
  "message": "Success",
  "data": {
    "token_type": "Bearer",
    "app_id": 1,
    "app_key": "ak_xxx",
    "access_token": "oat_xxx",
    "expires_in": 86400,
    "access_expires_at": "2026-08-27 12:00:00",
    "refresh_token": "ort_xxx",
    "refresh_expires_in": 2592000,
    "refresh_expires_at": "2026-09-25 12:00:00"
  }
}

Response fields

On success, data contains the token type, application details, both tokens, their lifetimes in seconds, and absolute expiration timestamps. Authentication failures return 401 without revealing whether the App Key or App Secret was incorrect.

Refresh tokens

Request body

Request example

curl --request POST "https://backend.biotech-mkt.com/openapi/auth/refresh" \
  --header "Content-Type: application/json" \
  --data '{"refresh_token":"ort_xxx"}'

Response example

The response has the same fields as the issue-token endpoint, but both tokens and expiration timestamps are new:

{
  "code": 200,
  "message": "Success",
  "data": {
    "token_type": "Bearer",
    "app_id": 1,
    "app_key": "ak_xxx",
    "access_token": "oat_new_xxx",
    "expires_in": 86400,
    "access_expires_at": "2026-08-27 13:00:00",
    "refresh_token": "ort_new_xxx",
    "refresh_expires_in": 2592000,
    "refresh_expires_at": "2026-09-25 13:00:00"
  }
}

Refresh uses token rotation. A successful response returns a new Access Token and a new Refresh Token, and both old tokens stop working.

Revoke tokens

Request body

Request example

curl --request POST "https://backend.biotech-mkt.com/openapi/auth/revoke" \
  --header "Content-Type: application/json" \
  --data '{"refresh_token":"ort_xxx"}'

Response example

{
  "code": 200,
  "message": "Success",
  "data": []
}

Revocation targets the token record identified by the Refresh Token. Repeating the request, or submitting a Refresh Token that no longer exists, is treated as an idempotent success.

Send an Access Token

Use the standard Bearer header:

Authorization: Bearer oat_xxx

Compatible alternative:

X-Openapi-Token: oat_xxx

When both headers are present and the Bearer header is validly formatted, the server uses Authorization. Access Tokens are not accepted in URL query parameters.

Authentication response headers

Token endpoints return:

• Cache-Control: no-store
• Pragma: no-cache
• X-Request-Id: <request ID>

A 401 response also includes WWW-Authenticate: Bearer.

Errors and rate limits

Authentication endpoints can return 401, 422, 429, 500, or 503. Deployment settings can override the defaults. See Errors and Rate Limits for limits, Retry-After, and retry guidance.

Security recommendations

• Store the App Secret and Refresh Token only in a server-side secret manager or encrypted storage.
• Log only token prefixes or irreversible fingerprints, never full values.
• Use HTTPS and never transmit credentials over plaintext HTTP.
• Reset the Secret immediately after a leak; doing so invalidates all existing tokens.