The Tarefy API uses JWT Bearer Token. Every protected endpoint requires the header:
Get a token
Use POST /v2/auth/login:
Response:
Expiration
Tarefy JWT tokens expire in 24 hours. When they expire, you receive:
Just call /auth/login again to get a new token.
Best practices
Never expose your token in client-side code, public repositories or logs. Anyone with the token has full account access.
- Store tokens in a secure environment (env vars, secret manager, httpOnly cookie)
- Use one token per integration when possible — easier to revoke
- Rotate if you suspect a leak (just change the user’s password)
Persistent API tokens (coming soon)
Currently only session JWT tokens (24h) are supported. Persistent scoped API tokens are on the roadmap.
Common errors