AAxis APIReference

Authentication

The API supports several auth mechanisms depending on who is calling. Almost all product endpoints use a JWT bearer token bound to the user guard; integrations and webhooks use API keys or signed verification instead.

JWT (user)304
Optional JWT248
Public26
Engage API key12
API key7
Sanctum token2

1 · JWT for the user guard

Authenticate against POST /api/user/login with an email and password. The response is a UserResource plus an access_token (a JWT), its token_expiry (unix timestamp) and a short-lived auth_code used by native apps to exchange for a session.

Login
curl -X POST 'https://api.axis.im/api/user/login' \
  -H 'Accept: application/json' -H 'Content-Type: application/json' \
  -d '{"email":"[email protected]","password":"secret-password","remember":true}'
200 OK
{
  "data": {
    "id": 42,
    "name": "Jane Doe",
    "email": "[email protected]",
    "workspaces_id": 7,
    "roles": ["admin"]
  },
  "access_token": "eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9...",
  "token_expiry": 1767225600,
  "auth_code": "a1b2c3d4"
}

Send the token on every authenticated request via the Authorization header:

curl 'https://api.axis.im/api/user/user' \
  -H 'Accept: application/json' \
  -H 'Authorization: Bearer {access_token}'
Current user
GET /api/user/user
Refresh token
POST /api/user/refresh
Log out
POST /api/user/logout

2 · Auth-code exchange (native apps)

Social / native flows return a one-time auth_code. Native clients call POST /api/user/generate-code and POST /api/user/generate-token to exchange that code for a JWT without re-entering credentials. These routes run under the auth.optional:user middleware so they resolve an existing session when present.

3 · Other schemes

API key

X-API-KEY: {key}

Programmatic integration endpoints are guarded by ApiKeyMiddleware, which reads the key from the X-API-KEY request header. Issue and rotate keys from the API Keys endpoints.

Engage Admin key

X-Axis-Admin-API-Key: {key}

Engage administrative endpoints accept the admin key via X-Axis-Admin-API-Key, falling back to X-API-KEY or a Bearer token. Validated against services.axis_admin.api_key.

Sanctum token

Authorization: Bearer {token}

A small number of routes use Laravel Sanctum personal-access tokens (auth:sanctum) rather than the JWT guard.

Facebook signed webhook

X-Hub-Signature-256

Meta webhook callbacks are verified by VerifyFacebookToken using the signed payload — no user token is involved.

Testing endpoints live

Every endpoint in the reference has a Try it tab that sends a real request. Click Authorize in the top bar once, paste your token, and it applies to every endpoint for the rest of the browser session (it is held in sessionStorage and never persisted to disk).

  1. Call POST /api/user/login — from its own Try-it tab — and copy the access_token.
  2. Click Authorize, choose JWT Bearer, paste the token and save.
  3. Open any endpoint, switch to Try it, adjust the prefilled payload and send.
These are real requests, not a sandbox. The console defaults to your local API; switching the base URL to production means sends, charges and deletions actually happen — mutating verbs there require an extra confirmation click.

Optional authentication

Many endpoints run under auth.optional:user. They work anonymously (e.g. public widget or webhook traffic) but will resolve and act on the authenticated user when a valid Bearer token is present. These are labelled Optional JWT throughout the reference.