Authentication

The Quper API uses Bearer JWT tokens issued by Auth0 for all authentication. Every request to the API must include a valid token in the Authorization header. Tokens are obtained via the Auth0 login flow and carry embedded claims that drive multi-tenant data isolation.

Request Header

Include the token as a Bearer credential in the Authorization header on every API request:

GET /api/v1/users HTTP/1.1
Host: api.quper.co
Authorization: Bearer eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9...
Content-Type: application/json

Obtaining a Token

Tokens are issued through the Auth0 authorization flow. The Quper web frontend handles token acquisition automatically via the Auth0 SDK and attaches the token to all outgoing API requests. For direct API access (scripts, integrations), use the Auth0 Client Credentials or Resource Owner Password flows with your tenant's Auth0 domain.

curl -X POST https://YOUR_AUTH0_DOMAIN/oauth/token \
  -H "Content-Type: application/json" \
  -d '{
    "client_id": "YOUR_CLIENT_ID",
    "client_secret": "YOUR_CLIENT_SECRET",
    "audience": "https://api.quper.co",
    "grant_type": "client_credentials"
  }'

JWT Token Claims

The JWT payload contains standard Auth0 claims plus Quper-specific custom claims. The API reads these claims on every request to determine the authenticated user's identity and scope.

Token Validation

The FastAPI backend validates tokens on every request using Auth0's JWKS endpoint. The validation checks:

• Token signature using Auth0's public RSA key
• Token expiration (exp claim)
• Audience (aud must match https://api.quper.co)
• Issuer (iss must match your Auth0 domain)

Error Responses

Authentication failures return standard HTTP error codes before any business logic is executed: