GUIDE
Authentication
Three audiences, one bearer token each. Which endpoint a token works on and how to read your own.
Every GraphQL request carries Authorization: Bearer <token>. The token says who you are and which shop you act in; nothing in the request body can change that.
Audiences and endpoints
| Audience | Endpoint | Who it is for |
|---|---|---|
app |
POST /graphql |
The N1 shop app: owners, accountants, supervisors, operators and QC. Always acts inside one shop. |
admin |
POST /platform/graphql |
The N1 administration portal (N1 staff). Never inside a shop. |
console |
POST /console/graphql |
Turret, the operations console (N1 staff). Never inside a shop. |
A token only works on its own endpoint. An app token on /console/graphql is refused with UNAUTHENTICATED, and so is the reverse. Each endpoint has its own schema, so a field built for Turret does not exist in the shop app.
Signing in
Shop users sign in with POST /auth/login (email or phone, and password) and receive a short-lived access token and a refresh token. Refreshing rotates the refresh token; using an old one revokes the session. Staff sign in with a second factor. Login ships with ticket N1C-021, so until then use the demo shop.
UNAUTHENTICATED as "refresh, then retry once", then send the user to sign in.Check who you are
The session query returns the audience, shop and roles the server read from your token. Use it after login or a refresh to confirm the shop you act in.
Rules that never change
- The shop always comes from the token, never from an argument. There is no
tenantIdto pass. - Only
POSTis accepted on GraphQL endpoints; documents and variables never go into URLs. - Limits apply before anything runs: see Response handling.