REST API Authentication & JWT Refresh Tokens

Learn how to authenticate incoming HTTPS requests to Repolit endpoints using JSON Web Tokens (JWT) and handle automatic token refresh cycles safely.

Overview

Repolit uses dual-token authentication for high-security developer API connections:

• Access Tokens: Short-lived (15 minutes), passed in Bearer headers.
• Refresh Tokens: Long-lived (30 days), stored in HTTP-only cookies.

Step 1: Requesting an Access Token

Send a POST request to /v1/oauth/token with your credentials:

curl -X POST https://api.repolit.io/v1/oauth/token \
  -H "Content-Type: application/json" \
  -d '{
    "client_id": "client_8f93120a",
    "client_secret": "sk_live_9921ab4c",
    "grant_type": "client_credentials"
  }'

Step 2: Client Token Handling in TypeScript

import { RepolitAuth } from '@repolit/sdk';

const auth = new RepolitAuth({
  clientId: process.env.REPOLIT_CLIENT_ID,
  clientSecret: process.env.REPOLIT_CLIENT_SECRET,
});

// Auto-handles token expiry & background refresh
const client = await auth.getAuthorizedClient();
const docs = await client.docs.list();

💡 Best Practice: Store tokens in memory or encrypted secure storage rather than localStorage to prevent XSS vulnerability.