JWT Usage
Overview
When you sign in to the Survanta mobile app, the server issues a JWT (JSON Web Token). This token proves your identity for every protected request the app makes on your behalf. You do not need to manage the token manually — the app handles it automatically.
What Is a JWT?
A JWT is a compact, signed token that carries identity claims. It is issued after successful mobile login and has a limited validity period. The current API exposes no refresh-token endpoint, so the user must sign in again after it expires.
How the App Uses Your Token
After a successful login, the client should store the JWT in platform-protected secure storage. For every protected request, including loading tasks, fetching survey details, or submitting a questionnaire, include this request header:
Authorization: Bearer <your-token>
This happens transparently. As a user, you simply use the app normally; the token is attached to each request without any action on your part.
Token Lifetime and Expiry
- The login response includes
expiresAtUtc; clients should use that server-provided value instead of assuming a duration. - There is no refresh-token or silent-refresh server contract.
- After expiry, discard the token and return the user to
POST /api/mobile/auth/login.
Token Security
- Store the JWT in a secure, platform-protected location; this is a client responsibility.
- Never share your token with anyone. A token grants the same access as your password for its duration.
- The backend exposes no logout or token-revocation endpoint. Client-side sign-out deletes the local copy but does not revoke an already issued JWT.
- Protected endpoints combine JWT validation with active-user, tenant, access-channel, and permission checks as applicable. A valid JWT must not be treated as sufficient authority by itself.
Authenticated vs. Public Access
| Access Type | Token Required | Who Uses It |
|---|---|---|
| Tenant User login | Yes — JWT Bearer | Eligible tenant users |
| Public survey via link, QR, or portal | Public access token; JWT optional in attributed flows | Anonymous guests or an authenticated tenant user |
The JWT you receive after login is separate from public survey tokens. Do not use your login JWT to share a survey publicly; use the QR or public token feature for that purpose.
Troubleshooting
- "Session expired" message: Your token has expired. Sign in again to continue.
- Requests failing with HTTP
401: The JWT is missing, malformed, invalid, or expired. Sign in again. - Requests failing with HTTP
403: Authentication succeeded, but the active user, tenant, access channel, or required permission did not authorize the operation. Contact your administrator if access is expected.
Subscription requirement
A JWT proves identity, never entitlement. A token issued before the subscription expired does not bypass the gate — subscription state is re-read on every protected request. A token obtained while expired is refused the same way, so re-authenticating is not a workaround.
After renewal the same still-valid token works again immediately: no restart, no re-login, no token refresh. Ordinary token expiry remains a separate matter with its own rules.