POST /api/login, then include it in the Authorization header of every subsequent call. This page explains the full authentication flow, token lifecycle, and how to recover from common auth errors.
Get a token
CallPOST /api/login with your email and password. The endpoint returns an access_token you use for all authenticated requests.
Endpoint: POST https://api.mogl.online/api/login
Successful response (
200 OK)
The login endpoint is rate-limited. Implement retry logic with exponential backoff if you receive a
429 Too Many Requests response.Attach the token to requests
Pass the token in theAuthorization header as a Bearer token on every authenticated request.
Token expiry and refresh
MOGL tokens are stateful JWTs managed server-side. There is no separate refresh token endpoint — when your token expires, re-authenticate by callingPOST /api/login again with your credentials to obtain a new token.
Invalidate a token
To explicitly invalidate your token — for example on user logout — callPOST /api/logout. After this call the token is no longer valid.
Auth errors
401 Unauthorized
A401 response means the request could not be authenticated. Common causes:
- Missing header — the
Authorization: Bearer <token>header was not included. - Invalid credentials — the email or password passed to
/api/loginwas incorrect. - Expired or invalidated token — the token has expired or was previously invalidated via
/api/logout.
POST /api/login to obtain a fresh token, then retry the request.
403 Forbidden
A403 response means the token is valid but the authenticated user does not have permission to access the resource. This typically happens when:
- An athlete calls an agent-only endpoint (or vice versa).
- A partner account attempts to access an admin-only route.