Authentication

Personal Access Tokens (PATs)

The simplest way to use the aYOUne API. Create a PAT in the admin UI under Settings → API Keys.

curl -H "Authorization: Bearer pat_your_token" \
  https://crm-api.ayoune.app/consumers

PATs inherit the permissions of the creating user. They don't expire but can be revoked at any time.

JWT (JSON Web Tokens)

For applications acting on behalf of a user. The auth service issues JWTs:

// Employee JWT
POST https://auth.ayoune.app/
Body: { username, password }

// Consumer JWT (end customer)
POST https://auth.ayoune.app/consumer/{customerSlug}
Body: { username, password }

OAuth 2.0

The authorization-code flow with PKCE lets third-party apps access the API on behalf of an aYOUne user without knowing their password. The actually granted access is always limited to the user's own rights at consent time (scope ∩ rights ∩ package).

# 1. Authorize (browser)
https://login.ayoune.app/oauth/authorize?response_type=code
  &client_id=oac_...&redirect_uri=...&scope=crm.consumers openid
  &state=<csrf>&code_challenge=<S256>&code_challenge_method=S256

# 2. Exchange the code for a token
POST https://auth.ayoune.app/oauth/token
  grant_type=authorization_code&code=...&code_verifier=...&client_id=oac_...

Discovery: https://auth.ayoune.app/.well-known/oauth-authorization-server

Full OAuth guide → Register your app → (sign-in required)