Authentication

Obtain and refresh access tokens for the Kravata Business API.

Your API credentials are the username and password of your Kravata Business account. You create the account yourself in the Kravata Business portal.

Get your credentials

Environment	Register	Reset password
Test	test-business.kravata.co/auth/register	test-business.kravata.co/auth/resetpassword
Production	business.kravata.co/auth/register	business.kravata.co/auth/resetpassword

1. Register your company

   Fill in the registration form: person type, ID type and number (NIT with its verification digit for companies), business name, contact data, a username and a password. Accept the data policy and the terms and conditions, and complete the reCAPTCHA.

2. Wait for approval

   Your account starts as pending. Kravata reviews your company and defines your business model. When it is approved, status and complianceStatus in Get Client Info become approved.

3. Use your credentials

   Send your username (not your email) and your password to POST /api/token.

Passwords must have at least 14 characters, including uppercase and lowercase letters, a number and a special character.

Forgot your password? Open the reset page, enter your ID type and number, and type the 6-digit code that Kravata sends to your registered email. Then choose a new password.

Tokens

You exchange your credentials for two JWT tokens:

Token	Validity	Use
access	5 minutes	Send it as Authorization: Bearer <access> in every request.
refresh	24 hours	Exchange it for a new access token without sending your password again.

Get your tokens

curl -X POST https://testapi.kravata.co/api/token \
  -H "Content-Type: application/json" \
  -d '{ "username": "YOUR_USERNAME", "password": "YOUR_PASSWORD" }'

{
  "refresh": "eyJhbGciOi...",
  "access": "eyJhbGciOi..."
}

Refresh the access token

When the access token expires, request a new one with the refresh token:

curl -X POST https://testapi.kravata.co/api/token/refresh \
  -H "Content-Type: application/json" \
  -d '{ "refresh": "YOUR_REFRESH_TOKEN" }'

{ "access": "eyJhbGciOi..." }

When the refresh token also expires, request a new pair with POST /api/token.

Authenticate your requests

curl https://testapi.kravata.co/api/infoClient \
  -H "Authorization: Bearer YOUR_ACCESS_TOKEN"

Most endpoints also require your clientId, in the path (/api/accounts/{clientId}) or as a query parameter (/api/ramps?clientId=...). Get it from Get Client Info.

Call the API only from your backend. Never expose your password or tokens in a browser or mobile app.