Authentication

Emfakt uses two separate authentication models. Setup and owner operations use control-plane JWT access tokens. Developer invoice integrations use developer API keys.

Control-plane JWT auth

Control-plane endpoints use a short-lived JWT access token:

Authorization: Bearer <access_token>

The login flow returns a JWT access token and an opaque refresh token. Refresh tokens are rotated on refresh and can be revoked on logout.

Control-plane auth is used for setup tasks such as account login, organization creation, and developer API-key management.

Developer API keys

Developer API endpoints use a bearer API key:

Authorization: Bearer sk_test_...

or, when live mode is enabled for the deployment:

Authorization: Bearer sk_live_...

These developer endpoints use API-key auth:

• GET /v1/me
• POST /v1/invoices
• GET /v1/invoices/{id}
• GET /v1/invoices/{id}/upo

API key modes

sk_test_... keys run deterministic sandbox invoice behavior. They do not call real KSeF TEST, DEMO, or production systems.

sk_live_... keys represent live API-key mode, but live submission is deployment-gated. A live key does not guarantee that live submission is available in every deployment. Live submissions require live mode to be enabled and organization KSeF TOKEN credentials to be stored.