Member Authentication Flow

This article guides you through the process of authenticating members and how to manage their session tokens effectively.

Initial Admin Login

When a member attempts to log in for the first time:

1. Send a POST request to the /api/{storeCode}/member/login_check endpoint with the member's credentials as a JSON payload.

{
  "username": "[e-mail]",
  "password": "password123"
}

2. Upon successful authentication, OpenLoyalty will return a response containing a JWT token and a refresh token:

{
  "token": "eyJhbGciOiJSUzI1NiIsInR5cCI...",
  "refresh_token": "def50200a2e8c9a2..."
}

This JWT token is critical as it must be included in the Authorization header as a Bearer token for the subsequent requests to the API.

Please note the list of endpoints utilizing a member's token is limited. The complete list can be found below the hint.

For the remaining endpoints, you still need to use the admin token.

List of endpoints utilizing member's token

1. Authentication

   https://apidocs.openloyalty.io/#operation/tokenRefreshMemberhttps://apidocs.openloyalty.io/#operation/memberLoginCheckhttps://apidocs.openloyalty.io/#operation/memberPostRegisterhttps://apidocs.openloyalty.io/#operation/memberPutPassword

2. Reset Password

   https://apidocs.openloyalty.io/#operation/memberPostPasswordReset

   https://apidocs.openloyalty.io/#operation/memberPostPasswordResetRequest

3. Campaigns https://apidocs.openloyalty.io/#operation/campaignAvailableMember

4. History

   https://apidocs.openloyalty.io/#operation/transactionGetList

   https://apidocs.openloyalty.io/#operation/memberGetHistory

   https://apidocs.openloyalty.io/#operation/memberGetTransferList

5. Member

   https://apidocs.openloyalty.io/#operation/memberGet

   https://apidocs.openloyalty.io/#operation/memberPut

   https://apidocs.openloyalty.io/#operation/memberGetStatus

6. Rewards

   https://apidocs.openloyalty.io/#operation/memberRewardGetList

   https://apidocs.openloyalty.io/#operation/rewardPostBuy

   https://apidocs.openloyalty.io/#operation/rewardGet

7. Wallets

   https://apidocs.openloyalty.io/#operation/memberWalletGetList

---

Maintaining Authentication State

The JWT token has a validity period of 24 hours. To continue interacting with the API beyond this period without requiring the member to log in again, you will need to refresh the token.

To ensure optimal performance of your environment, it's crucial to avoid frequent requests for JWT tokens, as this can significantly impact system efficiency.

1. Send a POST request to the /api/{storeCode}/token/refresh endpoint with the refresh token before the JWT token expires:

{
  "refresh_token": "def50200a2e8c9a2..."
}

2. If the refresh token is valid, OpenLoyalty will issue a new JWT token along with a new refresh token.

{
  "token": "eyJhbGciOiJSUzI1NiIsInR5cCI...",
  "refresh_token": "ghi78900b3f1c9d3..."
}

Replace the old JWT token with the new one in the Authorization header for all future requests utilizing member's token.

Sequence diagram for the authentication flow

---

Best Practices

• Token Security: It is critical to handle JWT tokens securely to protect them from interception or unauthorized access.

• Token Refresh Strategy: Implementing an automated refresh token strategy will enhance the user experience by preventing session disruptions.

• Error Handling: Your client application should be equipped to handle errors during the authentication process, including scenarios where the refresh token has expired, necessitating a full re-authentication.

By following these steps and best practices, you can integrate OpenLoyalty's authentication flow into your application, ensuring secure and seamless access to its API.

---

For additional details and best practices, you should consult the official OpenLoyalty API documentation (https://apidocs.openloyalty.io/), as it will provide the most accurate and up-to-date information, including any recent changes to the API, security advisories, and detailed endpoint descriptions.