sign-in

POST

{{base_url}}/v1/auth/sign-in

Exchanges the client's Mobile SDK client_id and client_secret for an access token.

Call it from the client backend before creating sessions. Use access_token in the Authorization: Bearer {access_token} header of every other request and pass it to the RS-ID SDK in the app. Reuse the token until expires_in seconds pass; then use refresh.

Authorization: not required.

Security: never put client_secret into the mobile app.

Request

Body Params application/jsonRequired

Examples

Responses

🟢200

application/json

Token issued (code = 0) or credentials rejected (code = -5).

Bodyapplication/json

🟠400

🔴500

Request Example

Shell

JavaScript

Java

Swift

curl --location --globoff '{{base_url}}/v1/auth/sign-in' \
--header 'Content-Type: application/json' \
--data '{
    "client_id": "mobile-sdk-client",
    "client_secret": "s3cr3t-value"
}'

Response Example

200 - Success

{
    "data": {
        "access_token": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiJ3ZWItc2RrLWNsaWVudCIsImV4cCI6MTc2MjI0NjQwMH0.4f8Jm2kq9XyTn1VbQ7cR0sLwZp3eHuGa6dKiOv5MtYs",
        "token_type": "Bearer",
        "expires_in": 3600,
        "scope": "read write",
        "refresh_token": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiJ3ZWItc2RrLWNsaWVudCIsInR5cCI6InJlZnJlc2gifQ.Qm7Lw2Zx8Cv4Bn1Ka9Ds3Fg6Hj0Rt5Ey2Up8Io4WaN"
    },
    "code": 0,
    "message": "Success"
}

Modified at 2026-11-04 12:25:35

Usage guide

refresh