Later Authentication

generated: '2026-08-13'
method: derived
source: openapi/later-influence-api-openapi.json
note: >-
  Derived from the Later Influence (formerly Mavrck) Swagger 2.0 contract published at
  https://api.mavrck.co/api-docs, then confirmed against live unauthenticated probes of
  https://api.mavrck.co/v1/*. The contract declares ONE security definition (an `api-key`
  header) but the operation descriptions and the live 401 bodies show a SECOND, distinct
  credential in use on the influencer-facing surface: a JWT minted by the /email-auth,
  /api-key/facebook and /auto-login operations and sent on subsequent requests. Later
  publishes no public developer portal for either surface, so no docs URL upgrades this
  to method searched.
summary:
  types:
  - apiKey
  - http
  api_key_in:
  - header
  oauth2: false
  openid_connect: false
  mutual_tls: false
schemes:
- name: apiKey
  type: apiKey
  in: header
  parameter: api-key
  declared: true
  applies_to: brand/admin operations (the default `security` block of the contract)
  sources:
  - openapi/later-influence-api-openapi.json
- name: jwt
  type: http
  scheme: bearer
  bearer_format: JWT
  declared: false
  applies_to: >-
    influencer-facing operations under /v1/later-influencers/{influencerIdOrCreatorId}
    and the Authentication tag token-exchange operations
  evidence:
  - kind: operation-description
    detail: >-
      "Pass an email and password in exchange for a JWT to include in the header of
      requests." — POST /email-auth/login (Authentication tag)
    source: openapi/later-influence-api-openapi.json
  - kind: live-probe
    url: https://api.mavrck.co/v1/later-influencers/1
    http_status: 401
    body: '{"message":"Unauthorized - Unable to verify the signed JWT token."}'
    fetched: '2026-08-13'
  sources:
  - openapi/later-influence-api-openapi.json
token_exchange_operations:
- method: POST
  path: /email-auth/login
  summary: Pass an email and password in exchange for a JWT.
- method: POST
  path: /email-auth/signup
  summary: Pass an email verification request key and new password in exchange for a JWT.
- method: POST
  path: /email-auth/reset-password
  summary: Pass an email reset password request key and new password in exchange for a JWT.
- method: POST
  path: /api-key/facebook
  summary: Pass Facebook access grant information in exchange for a JWT.
- method: POST
  path: /connected-account/instagram-business
  summary: Pass Facebook access grant information in exchange for a JWT.
- method: POST
  path: /auto-login
  summary: Pass an encrypted user key in exchange for a JWT.
- method: POST
  path: /v1/api-key/login
  operationId: loginAdmin
- method: POST
  path: /v1/api-key/swap-app
  operationId: swapCommunity
- method: POST
  path: /v1/auth/facebook/exchange-code-for-token
  operationId: exchangeCodeForToken
unauthenticated_behavior:
- url: https://api.mavrck.co/v1/influencers
  http_status: 403
  body: '{"type":"RESOURCE_FORBIDDEN_ERROR","error":"Access to this resource is forbidden."}'
  fetched: '2026-08-13'
- url: https://api.mavrck.co/v1/action-groups
  http_status: 403
  body: '{"type":"RESOURCE_FORBIDDEN_ERROR","error":"Access to this resource is forbidden."}'
  fetched: '2026-08-13'
gaps:
- The contract declares no oauth2, openIdConnect or mutualTLS scheme, so no OAuth scope
  reference can be derived; scopes/ is intentionally absent.
- The JWT credential is used but undeclared in `securityDefinitions`, so a generated
  client will not send it.
- No public credential-provisioning documentation is published on later.com; api-key
  issuance appears to be account-managed.