Authentication

The FinDesk API uses bearer tokens issued by Laravel Sanctum. You log in with your FinDesk email and password, the API returns a token, and every subsequent request carries that token in the Authorization header.

Coming soon — In-app token management (creating long-lived personal access tokens, revoking individual tokens, and scoping tokens to specific resources) is on the roadmap. Today, tokens are minted by POST /login and remain valid until the user's password changes.

• Obtaining a token
  • Register
• Using a token
• Failures

Obtaining a token#

Send the user's credentials to the login endpoint for the version you intend to call against:

• POST /api/v1/login — see v1 auth reference
• POST /api/v2/login — see v2 auth reference

POST /api/v2/login HTTP/1.1
Host: app.findesk.com.au
Accept: application/json
Content-Type: application/json

{
  "email": "you@example.com",
  "password": "secret"
}

A successful login responds with the authenticated user and a plaintext token:

{
  "user": { "id": 42, "email": "you@example.com", "name": "..." },
  "access_token": "4|GxR9...your-token..."
}

Store the access_token securely. The API does not return it again — if you lose it, you need to log in again to mint a new one.

Register#

POST /api/v{1,2}/register exists for completeness but is currently disabled and returns 403 Forbidden. Accounts are provisioned through the FinDesk web app.

Using a token#

Send the token as a Bearer credential and include the team header on every authenticated call:

GET /api/v2/applications HTTP/1.1
Host: app.findesk.com.au
Accept: application/json
Authorization: Bearer 4|GxR9...your-token...
X-Enterprise-Id: 1f8a9b2c-...-9e0f

The X-Enterprise-Id value is the UUID of the team (enterprise) you are reading from. Calls without it — or with one the authenticated user does not belong to — return 403 Forbidden.

Failures#

See Errors for the full list.