# Embat Authentication API

**Canonical:** https://apis.io/apis/embat/embat-authentication-api/  
**Provider:** Embat — https://apis.io/providers/embat/  
**Base URL:** https://api.embat.io  
**Documentation:** https://api.embat.io/docs

Embat Authentication API is one of 22 APIs that [Embat](https://apis.io/providers/embat/) publishes on the [APIs.io](https://apis.io/) network, described by a machine-readable OpenAPI specification. Tagged areas include Authentication. The published artifact set on APIs.io includes an OpenAPI specification, API documentation, and an API reference.

`Authentication` provides the credentials Embat issues to access the rest of the public API. Every other endpoint requires a JWT `idToken` in the `Authorization: Bearer <idToken>` header; requests with no token, or with an invalid or expired one, are rejected with `401`. An `email`/`password` pair identifies a service user with access to a group of companies in Embat. Keep these credentials secret: never commit them to a repository, embed them in client-side code, or expose them in publicly accessible logs. **Typical flow:** 1. Exchange your `email`/`password` for a bearer token: ```json POST /authentication/token { "email": "erp-integration@acme-corp.com", "password": "your-service-password" } ``` which returns: ```json { "idToken": "eyJhbGciOiJSUzI1NiIsImtpZCI6IjE5YzY4In0..." } ``` 2. Send that token as `Authorization: Bearer <idToken>` on every subsequent request. 3. The token expires **60 minutes** after issuance. Call `/authentication/token` again with the same credentials to get a new one; there is no separate refresh endpoint. 4. Accounts with multi-factor authentication enabled cannot authenticate through this endpoint. 5. If `email` or `password` is missing or malformed, the validation error response never echoes back the submitted values, so credentials are never reflected in error output. All requests must be made over **HTTPS**.

## Machine-readable artifacts (3)

- **OpenAPI** — https://raw.githubusercontent.com/api-evangelist/embat/refs/heads/main/openapi/embat-authentication-api-openapi.yml
- **Documentation** — https://api.embat.io/docs
- **APIReference** — https://api.embat.io/docs

## Other Embat APIs (12)

- [Embat AccountingAccounts API](https://apis.io/apis/embat/embat-accountingaccounts-api/)
- [Embat AccountingEntries API](https://apis.io/apis/embat/embat-accountingentries-api/)
- [Embat Attributes API](https://apis.io/apis/embat/embat-attributes-api/)
- [Embat Balances API](https://apis.io/apis/embat/embat-balances-api/)
- [Embat Banks API](https://apis.io/apis/embat/embat-banks-api/)
- [Embat Categories API](https://apis.io/apis/embat/embat-categories-api/)
- [Embat Companies API](https://apis.io/apis/embat/embat-companies-api/)
- [Embat Contacts API](https://apis.io/apis/embat/embat-contacts-api/)
- [Embat DebtScheduleConfigs API](https://apis.io/apis/embat/embat-debtscheduleconfigs-api/)
- [Embat Files API](https://apis.io/apis/embat/embat-files-api/)
- [Embat Forecasts API](https://apis.io/apis/embat/embat-forecasts-api/)
- [Embat ForeignExchangeRates API](https://apis.io/apis/embat/embat-foreignexchangerates-api/)

## Tags

Authentication

---

Profiled by [API Evangelist](https://apievangelist.com) and published on [APIs.io](https://apis.io/apis/embat/embat-authentication-api/). The API's provider profile, Kin Score and agent-readiness rating are at https://apis.io/providers/embat/.