Skip to content
Developer

Authentication

Sign in to the vynst (inwendo ERP) REST API with a session token or an API access token (JWT).

Every organisation runs its own instance of vynst (inwendo ERP) at its own address, for example https://club.iw-erp.de. All paths in this documentation are relative to that address. The code samples use your-instance.iw-erp.de.

The API knows two ways to sign in. Both send a token as an HTTP header.

Method Header Use it for
API access token (JWT) x-iw-jwt-token server to server, scripts, integrations
Email login x-session-token apps where a person signs in

API access token (JWT)

An API access token is the right choice for integrations. It belongs to a user, has that user’s rights and does not expire after a few hours.

  1. In the vynst admin area, open Settings → API, create an API access token and copy it.
  2. Send the token with every request in the x-iw-jwt-token header.
curl https://your-instance.iw-erp.de/api/base/api_access_token_test?mode=info \
  --header 'x-iw-jwt-token: <TOKEN>'

GET /api/base/api_access_token_test checks the token. With mode=info it also returns the user and the available scopes. The endpoints for access tokens are listed under Login and sessions.

Email login (session)

When a person signs in with email and password, POST /api/logins returns a session. Send its sessionid in the x-session-token header with every following request. POST /api/logouts ends the session.

curl --request POST https://your-instance.iw-erp.de/api/logins \
  --header 'content-type: application/json' \
  --data '{"login": {"username": "lena.hartmann@example.org", "password": "…"}}'

If two-factor sign-in is active for the account, confirm the session with GET /api/session/verify2fa/{id}/{code}.

Rights

Every call runs with the rights of the user the token belongs to. If a right is missing, the API answers 403. Give API access tokens only the rights the integration really needs.

OAuth for MCP and external services

AI assistants (MCP) and services such as Claude or ChatGPT use an OAuth flow that the person approves. The guide for it will follow in Integrations.