Authentication - Kralis Docs

Kralis uses one SimpleJWT token family across its GraphQL and REST authentication interfaces.

Client choice	Authenticate through	Product GraphQL route	Refresh through
GraphQL	`login` mutation	`/graphql/` or `/graphiql/`	`refreshLoginToken` mutation
REST	`POST /auth/login/`	`/graphql/` or `/graphiql/`	`POST /auth/token/refresh/`

The two login interfaces apply the same account, school, and Access-PIN rules and issue compatible access and refresh tokens. Choose one lifecycle and use it consistently in your client.

GraphQL authentication lifecycle

mutation Login($input: LoginInput!) {
  login(input: $input) {
    access
    refresh
    yearId
    termId
    user {
      id
      pk
      username
      fullName
      role
    }
    school {
      id
      pk
      schoolName
      schoolAcronym
      isActive
    }
  }
}

{
  "input": {
    "username": "YOUR_USERNAME",
    "password": "YOUR_PASSWORD_OR_ACCESS_PIN"
  }
}

REST authentication lifecycle

Endpoint	Purpose
`POST /auth/login/`	Exchange username and password or Access PIN for tokens
`GET /auth/user/`	Read current authenticated user details
`POST /auth/token/refresh/`	Rotate a valid refresh token and issue new tokens
`POST /auth/token/verify/`	Verify an access or refresh token
`POST /auth/logout/`	Revoke the submitted refresh token and end the session

Confirm current REST fields in Swagger or ReDoc.

Authorize GraphQL calls

Authorization: Bearer YOUR_ACCESS_TOKEN

The login response includes a deliberately limited user and school identity plus current academic context. Fetch fuller application data through the appropriate school-scoped GraphQL queries.

Refresh and revocation

mutation Refresh($input: RefreshLoginTokenInput!) {
  refreshLoginToken(input: $input) {
    access
    refresh
  }
}

mutation Verify($input: VerifyLoginTokenInput!) {
  verifyLoginToken(input: $input) {
    valid
  }
}

mutation Revoke($input: RevokeLoginTokenInput!) {
  revokeLoginToken(input: $input) {
    revoked
  }
}

Mutation	Input
`refreshLoginToken`	`{ "refresh": "YOUR_REFRESH_TOKEN" }`
`verifyLoginToken`	`{ "token": "YOUR_ACCESS_OR_REFRESH_TOKEN" }`
`revokeLoginToken`	`{ "refresh": "YOUR_REFRESH_TOKEN" }`

Refresh tokens rotate. After a successful refresh, replace both stored tokens with the returned access and refresh; the previous refresh token cannot be reused. If refresh fails, clear local authentication and require sign-in. Do not create an infinite retry loop.

Storage guidance

Client	Preferred approach
Server-rendered web app	Keep tokens server-side and expose an HttpOnly, Secure session cookie to the browser
Browser-only app	Minimize token exposure; do not place credentials in source, URLs, or analytics
Mobile app	Use the operating system’s secure credential storage
Development tool	Use temporary environment configuration excluded from version control

Never return tokens to logs, error trackers, browser URLs, screenshots, or public support messages.

​GraphQL authentication lifecycle

​REST authentication lifecycle

​Authorize GraphQL calls

​Refresh and revocation

​Storage guidance

GraphQL authentication lifecycle

REST authentication lifecycle

Authorize GraphQL calls

Refresh and revocation

Storage guidance