Authentication

OwlFlow uses a dual-layered authentication model.

1. Partner Authentication (API Key)

All requests to the production and staging environments require a valid API key provided via the x-api-key header. This is enforced by the Google API Gateway.

x-api-key: YOUR_PARTNER_API_KEY

2. User Authentication (JWT)

For user-specific operations (viewing profile, applying to scholarships), you must provide a Bearer token obtained from the login or googleAuth mutations.

Obtaining a Token

mutation Login($input: LoginInput!) {
  auth {
    login(input: $input) {
      token
      expiresAt
    }
  }
}

Using the Token

Include the token in the Authorization header of your requests:

Authorization: Bearer <your_token_here>

Token Lifecycle

• Tokens expire; the expiry is returned as expiresAt alongside the token.
• Use the refreshToken mutation to obtain a new token. Recently expired tokens are accepted for refresh within a grace window, so a briefly offline client can recover without forcing the user to log in again.
• Registration (createUser) also returns a token — a newly registered user is immediately authenticated. Send an Idempotency-Key header with registration requests so retries never create duplicate accounts (see the User Management examples).