---
title: "Authentication"
section: "API Reference"
route: /apiauth
account: {accountId}
bruce_api: https://{accountId}.api.nextspace.host
guardian_api: https://guardian.nextspace.host
---
# Authentication

The most basic form of authentication is to perform a user login HTTPS request and receive a token in the response.

Send that token as a bearer token in the `Authorization` header on every request to the Nextspace API:

```bash
Authorization: Bearer <token>
```

The same header accepts a session token from a user login and a long-lived access token, so code that authenticates a request does not need to know which kind of token it holds.

### Login

```http
POST https://guardian.nextspace.host/login
```

**Requires:** Nothing

**Request body**

```typescript
interface IPostBody {
    // Client Account ID.
    // This is your organization's ID.
    account: string;
    // Logic can be either your User ID, username, or email address.
    login: string;
    // Your user's password.
    password: string;
}
```

**Example request body**

```json
{
    "account": "my_account_id",
    "login": "jdoe",
    "password": "password123"
}
```

**Response**

```typescript
interface IResponse {
    // This is your token.
    // Send it as "Authorization: Bearer <token>" on any request you make to the Nextspace API.
    ID: string;
    // User record associated with the login.
    User: {
        // The user's ID.
        ID: string;
        // The user's username.
        Login?: string;
        // The user's email address.
        Email?: string;
        // The user's full name.
        Fullname?: string;
    }
}
```

**Javascript example**

```javascript
const url = "https://guardian.nextspace.host/login";
const method = "post";
const token = "your-token";
const body = {
    "account": "my_account_id",
    "login": "jdoe",
    "password": "password123"
};

async function doRequest(type, url, body, token) {
    const headers = {
        "Authorization": `Bearer ${token}`,
        "Content-Type": "application/json"
    };
    const options = {
        method: type,
        headers: headers,
        body: body ? JSON.stringify(body) : null
    };
    const res = await fetch(url, options);
    const json = await res.json();
    return json;
}

doRequest(method, url, body, token).then((res) => {
    console.log(res);
}).catch((err) => {
    console.error(err);
});
```

To invalidate the token, perform a logout HTTPS request authenticated with that same token.

### Logout

```http
POST https://guardian.nextspace.host/logout
```

**Requires:**

- Logged in user auth token: A token for an active user session on the account, sent as "Authorization: Bearer <token>".

**Javascript example**

```javascript
const url = "https://guardian.nextspace.host/logout";
const method = "post";
const token = "your-token";
const body = null;

async function doRequest(type, url, body, token) {
    const headers = {
        "Authorization": `Bearer ${token}`,
        "Content-Type": "application/json"
    };
    const options = {
        method: type,
        headers: headers,
        body: body ? JSON.stringify(body) : null
    };
    const res = await fetch(url, options);
    const json = await res.json();
    return json;
}

doRequest(method, url, body, token).then((res) => {
    console.log(res);
}).catch((err) => {
    console.error(err);
});
```

---

Urls on this page are resolved for account `{accountId}`.
Site index: https://docs.nextspace.host/llms.txt · whole site in one file: https://docs.nextspace.host/llms-full.txt
Human-readable version of this page: https://docs.nextspace.host/apiauth