Developer Docs / API / Auth

Authentication and bearer tokens

External integrations authenticate through Countera GraphQL, obtain a JWT access token, and pass it on subsequent GraphQL requests with the standard Authorization header.

Base URL

Use the GraphQL endpoint provided by Countera for your environment.

POST https://{your-countera-domain}/graphql
Content-Type: application/json

All examples below use https://api.example.countera.ai/graphql as a placeholder. Replace it with the URL supplied during onboarding.

Login mutation

Use the integration account credentials issued by Countera for your environment.

GraphQL mutationNo bearer token required

Request

curl -X POST "https://api.example.countera.ai/graphql" \
  -H "Content-Type: application/json" \
  -d '{
    "query": "mutation Login($input: LoginInput!) { login(input: $input) { token user { id username email firstName lastName roles { id name } } } }",
    "variables": {
      "input": {
        "username": "esl.integration@example.com",
        "password": "REPLACE_WITH_PASSWORD"
      }
    }
  }'

GraphQL document

mutation Login($input: LoginInput!) {
  login(input: $input) {
    token
    user {
      id
      username
      email
      firstName
      lastName
      roles {
        id
        name
      }
    }
  }
}

Variables

{
  "input": {
    "username": "esl.integration@example.com",
    "password": "REPLACE_WITH_PASSWORD"
  }
}

Successful response

{
  "data": {
    "login": {
      "token": "eyJhbGciOiJIUzI1NiJ9...",
      "user": {
        "id": "1042",
        "username": "esl.integration@example.com",
        "email": "esl.integration@example.com",
        "firstName": "ESL",
        "lastName": "Integration",
        "roles": [
          {
            "id": "ESL",
            "name": "ESL"
          }
        ]
      }
    }
  }
}
FieldTypeDescription
input.usernameStringIntegration username supplied by Countera.
input.passwordStringIntegration password supplied out of band.
login.tokenStringJWT access token used as a bearer token on subsequent calls.
login.user.rolesArrayFor ESL integrations, this should include ESL.

Using the token

Pass the token exactly as a bearer token in the Authorization header.

Authorization: Bearer eyJhbGciOiJIUzI1NiJ9...

Example authenticated request shell:

curl -X POST "https://api.example.countera.ai/graphql" \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer $COUNTERA_TOKEN" \
  -d '{"query":"query { externalProductPrices(variantUpdatedSince: \"2026-09-27T00:00:00Z\") { page totalRecords variants { variantId sku basePrice currency } } }"}'

Authentication errors

ConditionExpected resultResolution
Invalid username or passwordGraphQL error from loginConfirm credentials with Countera.
Missing bearer tokenAuthenticated API request rejectedLogin first, then send Authorization: Bearer ....
Expired or revoked tokenUnauthenticated/session expired errorRun the login mutation again and retry the request.
Request is rejectedGraphQL error responseConfirm the token, company context, and requested API operation with Countera.

Next step

After obtaining a token, call the product price API documented here:

External product price API