Skip to main content

Documentation Index

Fetch the complete documentation index at: https://docs.vouchmark.com/llms.txt

Use this file to discover all available pages before exploring further.

The Vouchmark API authenticates requests with a short-lived JWT access token. You exchange your account credentials (or a Google ID token) for an access token plus a refresh token, then attach the access token to every API call. The same credentials power the dashboard at vouchmark.com.

​
Get an access token

POST /v1/login returns an access token in the response body and sets a refresh-token cookie. For server-to-server use, ignore the cookie and store the accessToken value. 
curl -X POST https://api.vouchmark.com/v1/login \
  -H "Content-Type: application/json" \
  -d '{"email":"you@example.com","password":"••••••••"}'
Response
{
  "success": true,
  "accessToken": "eyJhbGciOiJIUzI1NiIs...",
  "user": {
    "id": "usr_...",
    "email": "you@example.com",
    "emailVerified": true
  }
}

​
Call the API

Pass the token as a Bearer credential on every request: 
curl https://api.vouchmark.com/v1/dashboard/my-companies \
  -H "Authorization: Bearer eyJhbGciOiJIUzI1NiIs..."
The middleware also accepts x-auth-token: <token> if you can’t set Authorization. Cookie-based auth (token cookie) works for browser clients but is not recommended for server integrations.

​
Refresh the token

Access tokens are short-lived (15 minutes). When the API responds with 401 TOKEN_EXPIRED, call POST /v1/refresh-token using the refresh token you received at login. You’ll get a fresh access token and a rotated refresh token.
Treat the refresh token like a password. Store it server-side in encrypted storage and never expose it to a browser unless the cookie is HttpOnly and Secure.

​
Sign out

Call POST /v1/logout with the access token to revoke it server-side. The token is blacklisted in Redis for the remainder of its lifetime, so even an unexpired copy is rejected.

​
Sandbox vs. production

There’s currently a single environment — https://api.vouchmark.com. A sandbox with isolated test data is on the roadmap; until then, use a non-production company record for integration testing.

​
Errors

StatusCodeMeaning
401NO_TOKENNo Authorization header.
401TOKEN_EXPIREDRefresh and retry.
401TOKEN_REVOKEDToken was blacklisted (logout, password change).
429—Rate limit exceeded. See Rate limits.
For the full set, see Errors.