Console
Drive the token lifecycle from the browser, or copy a token out and use it in curl/Postman instead — the API doesn't care which.
Access token
—
Refresh token
—
Log
API reference
POST /api/scenarios/api-auth/token
body { username, password } → { accessToken, refreshToken, expiresIn }
GET /api/scenarios/api-auth/protected
header Authorization: Bearer <accessToken> → 200 or 401 with a specific error code
POST /api/scenarios/api-auth/refresh
body { refreshToken } → a brand new access + refresh token pair (old refresh token revoked)
POST /api/scenarios/api-auth/revoke
body { refreshToken } → invalidates it immediately, before its natural expiry
curl -X POST https://playground.krishanchawla.com/api/scenarios/api-auth/token -H "Content-Type: application/json" -d '{"username":"standard_user","password":"Password123!"}'
curl https://playground.krishanchawla.com/api/scenarios/api-auth/protected -H "Authorization: Bearer <accessToken>"
curl -X POST https://playground.krishanchawla.com/api/scenarios/api-auth/refresh -H "Content-Type: application/json" -d '{"refreshToken":"<refreshToken>"}'