ABDM API — Authentication

/auth_token — POST (public, no token)

Issues the Firebase ID token used to authenticate every other endpoint. The token has an expiration time of 15 to 30 minutes. To obtain your integration email and password, see Getting integration credentials or email admin@nicehms.com.

Request fields

Example request

{
  "email": "integrator@example.com",
  "password": "your-password"
}

Example response

{
  "token": "eyJhbGciOiJSUzI1NiIsImtpZCI6..."
}

Response shape

Error codes

• VALIDATION_ERROR (400) — malformed body (bad email / missing password).
• UNAUTHORIZED (401) — invalid email or password.
• DB_ERROR (500) · INTERNAL_ERROR (500)

Notes: This endpoint is public (no token required) and does not check subscription.

Token lifecycle

• No refresh endpoint. There is no separate token-refresh call. When the token expires (or a call returns 401 UNAUTHORIZED), obtain a fresh token by calling /auth_token again with the same email and password.
• Reuse, don't re-mint. Call /auth_token once per session and reuse the token for all requests, rather than calling it before every endpoint.
• On 401 from another endpoint: the token is missing, malformed, expired, or not mapped to an organization. Get a new token from /auth_token and retry once.
• On 401 from /auth_token itself: the email or password is wrong — verify the credentials, or request a reset (see Getting integration credentials).
• On 500 from /auth_token: server-side failure — retry 2–3 times with backoff; escalate with the x-request-id if it persists.