> ## Documentation Index
> Fetch the complete documentation index at: https://docs.byblend.com/llms.txt
> Use this file to discover all available pages before exploring further.

# How do I authenticate with the Blend API?

> POST /api/v1/auth/login with your email and password to get a JWT access token. Send it as a Bearer token on every other request. Access tokens last 60 minutes; refresh tokens last 7 days.

Every Blend API request is authenticated with a JWT bearer token. You get one by posting your Blend credentials to `/api/v1/auth/login`, which returns both an `access_token` (valid 60 minutes) and a `refresh_token` (valid 7 days). Send the access token as `Authorization: Bearer {access_token}` on every subsequent call. The base URL is `https://api.byblend.com`.

## Get a token

```bash theme={null}
curl -X POST https://api.byblend.com/api/v1/auth/login \
  -H "Content-Type: application/json" \
  -d '{
    "email": "integrations@yourclinic.com",
    "password": "your-password"
  }'
```

Use the returned `access_token` on everything else:

```bash theme={null}
curl https://api.byblend.com/api/v1/orders \
  -H "Authorization: Bearer eyJhbGciOiJIUzI1NiIs..."
```

## Refresh before you expire

When the access token expires, call `/api/v1/auth/refresh` to get a new one without re-sending credentials.

<Warning>
  The refresh endpoint expects the **refresh token** in the `Authorization` header — not the access token. Sending the access token here is the single most common integration mistake.
</Warning>

```bash theme={null}
curl -X POST https://api.byblend.com/api/v1/auth/refresh \
  -H "Authorization: Bearer {refresh_token}"
```

<Tip>
  Refresh on a timer or on a `401`, rather than logging in fresh for every request. A 60-minute access token comfortably covers a batch job; a 7-day refresh token covers a week of unattended operation.
</Tip>

## Check a token without spending a request

`GET /api/v1/auth/verify` returns whether the current token is still valid, along with the user it belongs to — useful for health checks and for confirming which Blend account an integration is running as.

## Service accounts

Create a dedicated Blend user for your integration rather than authenticating as a person. Integration activity then shows up distinctly in order history and audit trails, and a staff member leaving your organization never breaks your pipeline.

<CardGroup cols={3}>
  <Card title="Generate token" icon="key" href="/api-reference/authentication/generate-token">
    POST /auth/login
  </Card>

  <Card title="Refresh access token" icon="rotate" href="/api-reference/authentication/refresh-access-token">
    POST /auth/refresh
  </Card>

  <Card title="Verify access token" icon="circle-check" href="/api-reference/authentication/verify-access-token">
    GET /auth/verify
  </Card>
</CardGroup>