Authentication
Authentication endpoints of the bizSupply API.
GET /api/v1/auth/login/{provider}
Initiate OAuth2 login with a supported Identity Provider.
Redirects the browser to the IDP authorization endpoint. Supports Google and Microsoft. GCP Marketplace SSO is handled when the request contains an x-gcp-marketplace-token form parameter.
Parameters
| Name | In | Required | Description |
|---|---|---|---|
provider | path | yes | Identity provider name (google or microsoft). |
redirectUrl | query | no | Optional frontend URL to redirect to after successful login. |
Responses
| Status | Description |
|---|---|
302 | Redirect to IDP authorization URL |
400 | Unsupported provider |
POST /api/v1/auth/login/{provider}
Parameters
| Name | In | Required | Description |
|---|---|---|---|
provider | path | yes | |
redirectUrl | query | no |
Responses
| Status | Description |
|---|---|
200 | OK |
POST /api/v1/auth/logout
Invalidate the current access token.
Adds the token to the Redis blacklist so it cannot be reused before its natural expiry. The client must also discard the token locally.
Parameters
| Name | In | Required | Description |
|---|---|---|---|
Authorization | header | yes |
Responses
| Status | Description |
|---|---|
204 | Token blacklisted, logout successful |
401 | No valid Bearer token provided |
POST /api/v1/auth/refresh
Refresh an expired access token.
Issues a new access token using the provided refresh token. An optional organizationId scopes the token to a specific org; otherwise the user's primary membership is used.
Request body
application/json→RefreshTokenRequest
Responses
| Status | Description |
|---|---|
200 | New access token issued |
401 | Invalid or expired refresh token |
POST /api/v1/auth/switch-org
Switch the authenticated user's active organization.
Re-issues the JWT scoped to the target organization. The caller must be a member of the target org. The response includes all memberships for the user.
Request body
application/json→SwitchOrganizationRequest
Responses
| Status | Description |
|---|---|
200 | New JWT issued for the target organization |
401 | Authentication required |
403 | Not a member of the target organization |