> ## Documentation Index
> Fetch the complete documentation index at: https://developer.arltechgroup.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

> How to get and use a JWT token on UAT and Production

## Overview

Every `/finance/` endpoint requires a JWT token sent in the `x-access-token` request header. Each environment has its own auth endpoint and issues independent tokens.

<Tabs>
  <Tab title="Production">
    **Base URL:** `https://api.arltechgroup.com`

    ## Get a token

    ```bash theme={null}
    curl -X POST https://api.arltechgroup.com/api/auth/signin \
      -H "Content-Type: application/json" \
      -d '{"username": "your_username", "password": "your_password"}'
    ```

    **Response**

    ```json theme={null}
    {
      "id": 1,
      "username": "your_username",
      "accessToken": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9..."
    }
    ```

    ## Use the token

    ```bash theme={null}
    curl https://api.arltechgroup.com/finance/customers \
      -H "x-access-token: eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9..."
    ```

    <Warning>
      Production credentials are live. All operations affect real customer accounts and devices.
    </Warning>
  </Tab>

  <Tab title="UAT">
    **Base URL:** `https://developer-uat.arltechgroup.com`

    ## Get a token

    ```bash theme={null}
    curl -X POST https://developer-uat.arltechgroup.com/api/auth/signin \
      -H "Content-Type: application/json" \
      -d '{"username": "your_uat_username", "password": "your_uat_password"}'
    ```

    **Response**

    ```json theme={null}
    {
      "id": 1,
      "username": "your_uat_username",
      "accessToken": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9..."
    }
    ```

    ## Use the token

    ```bash theme={null}
    curl https://developer-uat.arltechgroup.com/finance/customers \
      -H "x-access-token: eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9..."
    ```

    <Info>
      UAT is a sandbox environment. Test all integration flows here before switching to Production credentials.
    </Info>
  </Tab>
</Tabs>

## Token expiry

Tokens are valid for **24 hours** on both environments. After expiry you will receive:

```json theme={null}
{ "message": "Unauthorized! Access Token was expired!" }
```

Re-authenticate against the same environment to get a fresh token.

<Warning>
  Never expose your token in client-side code or commit it to version control. Store it in environment variables or a secrets manager.
</Warning>