Authentication
Pylo supports two authentication methods: user login (OAuth2) for user-facing applications and API tokens for server-to-server integrations.
| Method | Best for | Token lifetime |
|---|---|---|
| User login (OAuth2) | Web applications, user sessions | 1 hour (auto-refresh) |
| API tokens | Server integrations, scripts, CI/CD | Long-lived |
Use user login when you build a web application with user sessions and user-specific permissions. The Next.js integration handles login, logout, and token refresh.
Use API tokens for server-to-server integrations, automated scripts, and long-lived credentials without user login.
Making authenticated requests
With a user session (Bearer token):
terminal
1
2
3
4
curl -X POST https://api.pyloapp.com/graphql \
-H "Content-Type: application/json" \
-H "Authorization: Bearer YOUR_TOKEN" \
-d '{"query": "{ me { id email } }"}'With an API token:
terminal
1
2
3
4
curl -X POST https://api.pyloapp.com/graphql \
-H "Content-Type: application/json" \
-H "pylo-api-key: YOUR_API_KEY" \
-d '{"query": "{ customerList { data { id name } } }"}'OAuth2 flow
- User submits email and password
- Pylo validates credentials and returns tokens
- The auth token (1 hour) authenticates API requests
- The refresh token (7 days) gets new auth tokens
Login mutation
mutation
1
2
3
4
5
6
7
8
mutation Login($input: AuthRequest!) {
login(input: $input) {
data {
auth_token
refresh_token
}
}
}Token refresh
mutation
1
2
3
4
5
6
7
8
mutation RefreshToken($input: AuthRefreshRequest!) {
refreshToken(input: $input) {
data {
auth_token
refresh_token
}
}
}Automatic refresh
With the Next.js integration, the middleware refreshes tokens before they expire. You never touch them yourself.
Public endpoints
To expose public-facing endpoints without user authentication, create an API token with restrictive permissions and send it with your requests.