Skip to main content
The Tarefy API uses JWT Bearer Token. Every protected endpoint requires the header:

Get a token

Use POST /v2/auth/login:
Response:

Expiration

Tarefy JWT tokens expire in 24 hours. When they expire, you receive:
Just call /auth/login again to get a new token.

Best practices

Never expose your token in client-side code, public repositories or logs. Anyone with the token has full account access.
  • Store tokens in a secure environment (env vars, secret manager, httpOnly cookie)
  • Use one token per integration when possible — easier to revoke
  • Rotate if you suspect a leak (just change the user’s password)

Persistent API tokens (coming soon)

Currently only session JWT tokens (24h) are supported. Persistent scoped API tokens are on the roadmap.

Common errors