> For the complete documentation index, see [llms.txt](https://docs.icomplyis.com/api-docs/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.icomplyis.com/api-docs/authentication.md).

# Authentication

Authentication is handled via JWT tokens or with an API Key.  Please contact your iComply Account Manager for your API credentials and API Key.

{% hint style="info" %}
**Note:** Your iComply Account Manager will provide you with your API credentials and API Key when your account is first created.  If you have any issue authenticating with the iComply API, please contact iComply support and we will be happy to assist you.
{% endhint %}

## JWT Token

To interact with the iComply API from front-end applications, we generally recommend authenticating with our API using short-lived JWT tokens.  The generated a token for future API calls, make a POST request to **api.icomplykyc.com/api/gettoken** using the credentials provided to you by your account manager.

![Sample Postman Request to Get a JWT Token](https://717629513-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FvWFRXVvGJeCfwWFrLS1l%2Fuploads%2FZHAVPT3hgHTwwOoKZLeY%2Fimage.png?alt=media\&token=fa79de57-d78c-47e8-8695-719e4301926e)

This token will be valid for 20 minutes and can be used as a Bearer Token in the header of subsequent API calls.

![A Valid JWT Token can be entered on Authorization Tab in Postman](https://717629513-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FvWFRXVvGJeCfwWFrLS1l%2Fuploads%2Fv3Y4LvjPYqjXVqQR5PAp%2Fimage.png?alt=media\&token=5b1e781f-74f4-4e74-af0d-0db4c87f42f2)

An invalid or expired token will result in a 401 Unauthorized response.

## Get Token Request

To make your first request, send an authenticated request to the gettoken endpoint. This will generate a `token` which can be used to authenticate subsequent API requests.

## Generate JWT Token.

<mark style="color:green;">`POST`</mark> `https://api.icomplykyc.com/api/gettoken`

Creates a new JWT Token that is valid for 20 minutes.  Make sure to select "form-data" on the Body tab in Postman when making a POST request to the gettoken endpoint.

#### Request Body

| Name                                       | Type   | Description                  |
| ------------------------------------------ | ------ | ---------------------------- |
| Username<mark style="color:red;">\*</mark> | string | The username provided to you |
| Password                                   | string | The password provided to you |

{% tabs %}
{% tab title="200 JWT Token successfully generated" %}

```javascript
{
     "token": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ..."
}
```

{% endtab %}

{% tab title="401 Unauthorized" %}
Unauthorized can be returned if you enter the wrong credentials.
{% endtab %}
{% endtabs %}

## Validate Token

To check whether a JWT token is valid and has not expired, you can call the **tokenvalid** endpoint.

![Sample Authorization Header with JWT Token](https://717629513-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FvWFRXVvGJeCfwWFrLS1l%2Fuploads%2Fr3068Encwd5KxRSPSatG%2Fimage.png?alt=media\&token=24022011-aa89-49e9-b23c-19b279dcb1e2)

## Token Valid

<mark style="color:blue;">`GET`</mark> `https://api.icomplykyc.com/api/tokenvalid`

Check whether a JWT token is valid and has not expired.

**Authentication Type:** JWT Token

#### Headers

| Name                                            | Type   | Description                        |
| ----------------------------------------------- | ------ | ---------------------------------- |
| Authorization<mark style="color:red;">\*</mark> | String | The JWT Token you want to validate |

{% tabs %}
{% tab title="200: OK " %}

```javascript
{
    "isTokenValid": true
}
```

{% endtab %}

{% tab title="401: Unauthorized " %}
If the token has expired or is invalid the endpoint will return a 401 unauthorized error code with no body.
{% endtab %}
{% endtabs %}

## API Key

For communicating with our API with back-end services, we recommend using an API Key.  An API Key will be provided to you when you setup your account.  It can be used as follows to authenticate with the iComply API.

![Sample API Key Authentication](https://717629513-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FvWFRXVvGJeCfwWFrLS1l%2Fuploads%2FeBlipBJIVJBAibo4WowK%2Fimage.png?alt=media\&token=2f175b3f-373a-4f06-b5ac-3898a086b374)

An invalid API Key will return a 401 Unauthorized response.&#x20;

{% hint style="info" %}
Your API Key is long-lived and does not expire and must be securely stored in a Key Vault and ONLY used for server to server communication.  It should never be used with front end libraries like React where an attacker could retrieve your API Key.  If you suspect your API key has been compromised, contact support immediately to have your key invalidated and reset.
{% endhint %}