Auth

OAuth 2.0 token lifecycle (Laravel Passport) and logout

Revoke the credential used on this request (log out this device)#

POST /api/v1/logout

Requires authentication (Bearer token) and the X-Organization-Id header.

Revokes the Passport access token AND its refresh token (or deletes the Sanctum token) that authenticated this request. Revocation is immediate: the next API call with the same token returns 401, and refreshing with its refresh token returns 400 invalid_grant.

Organization API tokens are managed in the admin panel and are rejected here with 400 invalid_token_type. Calling logout twice with the same token yields 401 on the second call (the token is already revoked).

Responses#

Example request#

curl -X POST "https://app.encryptinvoice.com/api/v1/logout" \
  -H "Authorization: Bearer {{access_token}}" \
  -H "X-Organization-Id: {{organization_id}}" \
  -H "Accept: application/json"

Revoke ALL of the user's tokens (log out every device)#

POST /api/v1/logout-all

Requires authentication (Bearer token) and the X-Organization-Id header.

Revokes every Passport access + refresh token and deletes every Sanctum personal access token belonging to the authenticated user — all devices and sessions. Same error contract as /api/v1/logout: organization API tokens get 400 invalid_token_type.

Responses#

Example request#

curl -X POST "https://app.encryptinvoice.com/api/v1/logout-all" \
  -H "Authorization: Bearer {{access_token}}" \
  -H "X-Organization-Id: {{organization_id}}" \
  -H "Accept: application/json"

Current authenticated user#

GET /api/v1/user

Requires authentication (Bearer token) and the X-Organization-Id header.

Returns the authenticated user. There is no dedicated /me; this is the closest equivalent.

Responses#

Example request#

curl -X GET "https://app.encryptinvoice.com/api/v1/user" \
  -H "Authorization: Bearer {{access_token}}" \
  -H "X-Organization-Id: {{organization_id}}" \
  -H "Accept: application/json"

Start the OAuth2 Authorization Code + PKCE flow#

GET /oauth/authorize

Open this URL in the system browser (NOT a WebView). Unauthenticated users are first redirected to /login and return here after signing in.

For first-party clients (the EncryptInvoice mobile app) the consent screen is auto-skipped: the browser is immediately redirected to redirect_uri with code and state. Third-party clients get a consent screen (HTTP 200) first.

PKCE is mandatory for public clients: send code_challenge (Base64url-encoded SHA-256 of a random 43–128 char code_verifier) and code_challenge_method=S256. Verify the returned state matches what you sent before exchanging the code.

Parameters#

Responses#

Example request#

curl -X GET "https://app.encryptinvoice.com/oauth/authorize" \
  -H "Authorization: Bearer {{access_token}}" \
  -H "X-Organization-Id: {{organization_id}}" \
  -H "Accept: application/json"

Exchange an authorization code, refresh token, or (deprecated) password for tokens#

POST /oauth/token

Token endpoint for all grants. Send application/x-www-form-urlencoded (JSON bodies are also accepted).

• authorization_code + PKCE (PRIMARY, mobile): public client — send code_verifier, NO client_secret. The mobile app is a first-party client, so the issued token is user-scoped (organization_id stays NULL) — any organization_id sent is ignored, and the active org is chosen per request via the X-Organization-Id header (see Organization context). For non-first-party (org-scoped) clients, organization_id binds the token to that org; omitted = the user's primary org.
• refresh_token: refresh tokens ROTATE — the old refresh token is revoked on use; always store the new pair. (Org-scoped only: re-send organization_id to keep a non-primary binding; user-scoped tokens stay NULL.)
• password (DEPRECATED): legacy/web integrations only — mobile MUST use PKCE.

After logout (or any revocation) the access token immediately fails with 401 and its refresh token is revoked (refresh attempts return 400 invalid_grant).

Responses#

Example request#

curl -X POST "https://app.encryptinvoice.com/oauth/token" \
  -H "Authorization: Bearer {{access_token}}" \
  -H "X-Organization-Id: {{organization_id}}" \
  -H "Accept: application/json"