Authentication

auth.createUser and auth.login authenticate students with an email address and password. Both mutations return a JWT. Send it on later requests as Authorization: Bearer <token>.

For domain-based integrations, Owlflow reads the Host header during registration and sign-in. Don't send a domain in the GraphQL input. Partner identification documents the hostname lookup.

Create an account

Include an Idempotency-Key header when creating an account through auth.createUser. Generate a new UUID for each registration attempt. If you retry the same attempt with the same key, Owlflow returns the original result instead of creating another account. Keep the key at 128 characters or fewer.

mutation Signup($input: CreateUserInput!) {
  auth {
    createUser(input: $input) {
      success
      token
      expiresAt
      user {
        id
        email
        firstName
        lastName
      }
      errors {
        code
        field
        message
      }
    }
  }
}

auth.createUser requires CreateUserInput.email. Successful registration returns a token and signs the student in immediately.

Sign in

mutation Login($input: LoginInput!) {
  auth {
    login(input: $input) {
      token
      expiresAt
      user {
        id
        email
        firstName
        lastName
      }
    }
  }
}

LoginInput contains email, password, and the optional remember field.

Refresh and sign out

Call auth.refreshToken before the current token expires. Owlflow returns a new token and expiresAt. Owlflow also accepts a recently expired token during the refresh grace period.

Call auth.logout to revoke the current token. Owlflow returns true when revocation succeeds.

Who is signed in

query CurrentUser {
  me {
    id
    email
    firstName
    lastName
  }
}