Authentication

Finindex uses JWT-based authentication via Supabase Auth, shared with the Cutmake API. Obtain an access_token, send it as a Bearer token on every request, and refresh it before it expires. Login is form-encoded (application/x-www-form-urlencoded) with username and password fields. The username field is the user’s email address.

username

string

required

User’s email address

password

string

required

User’s password

POST /api/v1/auth/login
Content-Type: application/x-www-form-urlencoded

username=user@example.com&password=securepass123

curl -X POST https://vinmake-erp.onrender.com/api/v1/auth/login \
  -H "Content-Type: application/x-www-form-urlencoded" \
  -d "username=user@example.com" \
  -d "password=securepass123"

Response (200):

{
  "access_token": "eyJ...",
  "refresh_token": "eyJ...",
  "token_type": "bearer"
}

Refresh

Exchange a valid refresh_token for a new access_token.

refresh_token

string

required

The refresh token issued at login

POST /api/v1/auth/refresh
Content-Type: application/json

{
  "refresh_token": "eyJ..."
}

Response (200):

{
  "access_token": "eyJ...",
  "refresh_token": "eyJ...",
  "token_type": "bearer"
}

Using the Token

Send the access token as a Bearer token on every authenticated request:

GET /api/v1/gl/accounts
Authorization: Bearer <access_token>

Store the refresh_token securely and call POST /auth/refresh when the access token nears expiry rather than re-prompting for credentials.

Requests without a valid Bearer token return 401 Unauthorized. Requests for resources outside your organization return 403 Forbidden.

​Authentication

​Login

​Refresh

​Using the Token

Authentication

Login

Refresh

Using the Token