🔐 Fake Auth API (JWT login)

Q: Why do I get 401 invalid_token?

The header must be exactly Authorization: Bearer <accessToken>. A refresh token or an edited token is rejected.

Practise login screens, token storage and authenticated requests with demo accounts.

Every app needs a login screen, and testing it usually means waiting for a backend. The Fake Auth API answers like a real one: send a username and password, receive an access token and a refresh token (signed JWTs), then send Authorization: Bearer <token> to get the current user.

Wrong passwords return 401, expired or edited tokens are rejected, and you can choose a short lifetime to test your refresh logic. Demo only: the signing key is public, so never use these tokens to protect real data.

Base URL https://toolorca.com/api/v1 No key · CORS open · JSON · conventions and limits

POST `/api/v1/auth/login` #

Parameter	In	Type	Description
`username` required	body	string	A demo username (or email), e.g. `sokha.chan`.
`password` required	body	string	Always `demo1234`.
`expiresInMins`	body	integer	Access token lifetime, 1–1440 minutes (default 60).

curl -X POST 'https://toolorca.com/api/v1/auth/login' \
  -H 'Content-Type: application/json' \
  -d '{"username":"sokha.chan","password":"demo1234","expiresInMins":60}'

const res = await fetch('https://toolorca.com/api/v1/auth/login', {
  method: 'POST',
  headers: { 'Content-Type': 'application/json' },
  body: JSON.stringify({
    "username": "sokha.chan",
    "password": "demo1234",
    "expiresInMins": 60
  }),
});
if (!res.ok) throw new Error(`HTTP ${res.status}`);
const data = await res.json();
console.log(data);

import 'dart:convert';
import 'package:http/http.dart' as http;

Future<void> main() async {
  final res = await http.post(
    Uri.parse('https://toolorca.com/api/v1/auth/login'),
    headers: {'Content-Type': 'application/json'},
    body: jsonEncode({
      'username': 'sokha.chan',
      'password': 'demo1234',
      'expiresInMins': 60,
    }),
  );
  if (res.statusCode >= 400) throw Exception('HTTP ${res.statusCode}');
  final data = jsonDecode(utf8.decode(res.bodyBytes));
  print(data);
}

import okhttp3.MediaType.Companion.toMediaType
import okhttp3.OkHttpClient
import okhttp3.Request
import okhttp3.RequestBody.Companion.toRequestBody

// Call from a background thread or coroutine (Dispatchers.IO), never the main thread.
val client = OkHttpClient()
val json = """
{
  "username": "sokha.chan",
  "password": "demo1234",
  "expiresInMins": 60
}
""".trimIndent()
val request = Request.Builder()
    .url("https://toolorca.com/api/v1/auth/login")
    .post(json.toRequestBody("application/json".toMediaType()))
    .build()
client.newCall(request).execute().use { res ->
    if (!res.isSuccessful) error("HTTP ${res.code}")
    println(res.body?.string())
}

import Foundation

var request = URLRequest(url: URL(string: "https://toolorca.com/api/v1/auth/login")!)
request.httpMethod = "POST"
request.setValue("application/json", forHTTPHeaderField: "Content-Type")
request.httpBody = """
{
  \"username\": \"sokha.chan\",
  \"password\": \"demo1234\",
  \"expiresInMins\": 60
}
""".data(using: .utf8)
let (data, response) = try await URLSession.shared.data(for: request)
guard let http = response as? HTTPURLResponse, http.statusCode < 400 else {
    throw URLError(.badServerResponse)
}
print(String(decoding: data, as: UTF8.self))

POST /auth/login

Example response

{
  "tokenType": "Bearer",
  "accessToken": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOjEsInVzZXJuYW1lIjoic29raGEuY2hhbiIsInJvbGUiOiJhZG1pbiIsInR5cGUiOiJhY2Nlc3MiLCJpYXQiOjE3OTQ2MzMzMjUsImV4cCI6MTc5NDYzNjkyNSwiaXNzIjoidG9vbG9yY2EtZGVtbyJ9.ttto7BIBx6WYDPWmgQvwy6LiIYlsLdE_MaHcjAgEquQ",
  "refreshToken": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOjEsInR5cGUiOiJyZWZyZXNoIiwiaWF0IjoxNzk0NjMzMzI1LCJleHAiOjE3OTUyMzgxMjUsImlzcyI6InRvb2xvcmNhLWRlbW8ifQ.ngcT7bCNwPLwfyEDksZs_P_blxgXsPhALKTQWiy2Tfs",
  "expiresIn": 3600,
  "user": {
    "id": 1,
    "firstName": "Sokha",
    "lastName": "Chan",
    "fullName": "Chan Sokha",
    "firstNameKm": "សុខា",
    "lastNameKm": "ចាន់",
    "fullNameKm": "ចាន់ សុខា",
    "username": "sokha.chan",
    "email": "sokha.chan@example.com",
    "phone": "+855 17 915 876",
    "gender": "female",
    "birthDate": "1984-12-24",
    "age": 41,
    "role": "admin",
    "avatar": "https://toolorca.com/api/v1/images/placeholder/200x200.png?text=SC&bg=0f6fde&fg=ffffff",
    "address": {
      "street": "No. 13, Street 2004",
      "city": "Phnom Penh",
      "cityKm": "ភ្នំពេញ",
      "postalCode": "12072",
      "country": "Cambodia",
      "countryCode": "KH",
      "coordinates": {
        "lat": 11.5344,
        "lng": 104.9561
      }
    },
    "company": {
      "name": "Sabay Learning Center",
      "department": "Marketing",
      "title": "Mobile Developer"
    },
    "language": "km",
    "createdAt": "2024-02-22T00:00:00Z"
  }
}

GET `/api/v1/auth/me` #

The user that owns the access token.

Returns 401 with code missing_token, invalid_token or token_expired when the token is missing, edited or too old. Try it logs in as sokha.chan first.

Parameter	In	Type	Description
`Authorization` required	header	string	`Bearer <accessToken>`

curl 'https://toolorca.com/api/v1/auth/me' \
  -H 'Authorization: Bearer YOUR_ACCESS_TOKEN'

const token = 'YOUR_ACCESS_TOKEN';
const res = await fetch('https://toolorca.com/api/v1/auth/me', {
  headers: { Authorization: `Bearer ${token}` },
});
if (!res.ok) throw new Error(`HTTP ${res.status}`);
const data = await res.json();
console.log(data);

import 'dart:convert';
import 'package:http/http.dart' as http;

Future<void> main() async {
  const token = 'YOUR_ACCESS_TOKEN';
  final res = await http.get(
    Uri.parse('https://toolorca.com/api/v1/auth/me'),
    headers: {'Authorization': 'Bearer $token'},
  );
  if (res.statusCode >= 400) throw Exception('HTTP ${res.statusCode}');
  final data = jsonDecode(utf8.decode(res.bodyBytes));
  print(data);
}

import okhttp3.MediaType.Companion.toMediaType
import okhttp3.OkHttpClient
import okhttp3.Request
import okhttp3.RequestBody.Companion.toRequestBody

// Call from a background thread or coroutine (Dispatchers.IO), never the main thread.
val token = "YOUR_ACCESS_TOKEN"
val client = OkHttpClient()
val request = Request.Builder()
    .url("https://toolorca.com/api/v1/auth/me")
    .header("Authorization", "Bearer $token")
    .build()
client.newCall(request).execute().use { res ->
    if (!res.isSuccessful) error("HTTP ${res.code}")
    println(res.body?.string())
}

import Foundation

let token = "YOUR_ACCESS_TOKEN"
var request = URLRequest(url: URL(string: "https://toolorca.com/api/v1/auth/me")!)
request.setValue("Bearer \(token)", forHTTPHeaderField: "Authorization")
let (data, response) = try await URLSession.shared.data(for: request)
guard let http = response as? HTTPURLResponse, http.statusCode < 400 else {
    throw URLError(.badServerResponse)
}
print(String(decoding: data, as: UTF8.self))

GET /auth/me

Example response

{
  "id": 1,
  "firstName": "Sokha",
  "lastName": "Chan",
  "fullName": "Chan Sokha",
  "firstNameKm": "សុខា",
  "lastNameKm": "ចាន់",
  "fullNameKm": "ចាន់ សុខា",
  "username": "sokha.chan",
  "email": "sokha.chan@example.com",
  "phone": "+855 17 915 876",
  "gender": "female",
  "birthDate": "1984-12-24",
  "age": 41,
  "role": "admin",
  "avatar": "https://toolorca.com/api/v1/images/placeholder/200x200.png?text=SC&bg=0f6fde&fg=ffffff",
  "address": {
    "street": "No. 13, Street 2004",
    "city": "Phnom Penh",
    "cityKm": "ភ្នំពេញ",
    "postalCode": "12072",
    "country": "Cambodia",
    "countryCode": "KH",
    "coordinates": {
      "lat": 11.5344,
      "lng": 104.9561
    }
  },
  "company": {
    "name": "Sabay Learning Center",
    "department": "Marketing",
    "title": "Mobile Developer"
  },
  "language": "km",
  "createdAt": "2024-02-22T00:00:00Z"
}

POST `/api/v1/auth/refresh` #

Swap a refresh token (valid 7 days) for a new access token and refresh token.

Parameter	In	Type	Description
`refreshToken` required	body	string	The refresh token from login.
`expiresInMins`	body	integer	New access token lifetime (default 60).

curl -X POST 'https://toolorca.com/api/v1/auth/refresh' \
  -H 'Content-Type: application/json' \
  -d '{"refreshToken":"YOUR_REFRESH_TOKEN","expiresInMins":60}'

const res = await fetch('https://toolorca.com/api/v1/auth/refresh', {
  method: 'POST',
  headers: { 'Content-Type': 'application/json' },
  body: JSON.stringify({
    "refreshToken": "YOUR_REFRESH_TOKEN",
    "expiresInMins": 60
  }),
});
if (!res.ok) throw new Error(`HTTP ${res.status}`);
const data = await res.json();
console.log(data);

import 'dart:convert';
import 'package:http/http.dart' as http;

Future<void> main() async {
  final res = await http.post(
    Uri.parse('https://toolorca.com/api/v1/auth/refresh'),
    headers: {'Content-Type': 'application/json'},
    body: jsonEncode({
      'refreshToken': 'YOUR_REFRESH_TOKEN',
      'expiresInMins': 60,
    }),
  );
  if (res.statusCode >= 400) throw Exception('HTTP ${res.statusCode}');
  final data = jsonDecode(utf8.decode(res.bodyBytes));
  print(data);
}

import okhttp3.MediaType.Companion.toMediaType
import okhttp3.OkHttpClient
import okhttp3.Request
import okhttp3.RequestBody.Companion.toRequestBody

// Call from a background thread or coroutine (Dispatchers.IO), never the main thread.
val client = OkHttpClient()
val json = """
{
  "refreshToken": "YOUR_REFRESH_TOKEN",
  "expiresInMins": 60
}
""".trimIndent()
val request = Request.Builder()
    .url("https://toolorca.com/api/v1/auth/refresh")
    .post(json.toRequestBody("application/json".toMediaType()))
    .build()
client.newCall(request).execute().use { res ->
    if (!res.isSuccessful) error("HTTP ${res.code}")
    println(res.body?.string())
}

import Foundation

var request = URLRequest(url: URL(string: "https://toolorca.com/api/v1/auth/refresh")!)
request.httpMethod = "POST"
request.setValue("application/json", forHTTPHeaderField: "Content-Type")
request.httpBody = """
{
  \"refreshToken\": \"YOUR_REFRESH_TOKEN\",
  \"expiresInMins\": 60
}
""".data(using: .utf8)
let (data, response) = try await URLSession.shared.data(for: request)
guard let http = response as? HTTPURLResponse, http.statusCode < 400 else {
    throw URLError(.badServerResponse)
}
print(String(decoding: data, as: UTF8.self))

POST /auth/refresh

Example response

{
  "tokenType": "Bearer",
  "accessToken": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOjEsInVzZXJuYW1lIjoic29raGEuY2hhbiIsInJvbGUiOiJhZG1pbiIsInR5cGUiOiJhY2Nlc3MiLCJpYXQiOjE3OTQ2MzMzMjUsImV4cCI6MTc5NDYzNjkyNSwiaXNzIjoidG9vbG9yY2EtZGVtbyJ9.ttto7BIBx6WYDPWmgQvwy6LiIYlsLdE_MaHcjAgEquQ",
  "refreshToken": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOjEsInR5cGUiOiJyZWZyZXNoIiwiaWF0IjoxNzk0NjMzMzI1LCJleHAiOjE3OTUyMzgxMjUsImlzcyI6InRvb2xvcmNhLWRlbW8ifQ.ngcT7bCNwPLwfyEDksZs_P_blxgXsPhALKTQWiy2Tfs",
  "expiresIn": 3600
}

Demo accounts

All 30 fake users can log in with the password demo1234. Good ones to start with: sokha.chan (admin), dara.sok (moderator), sophea.kim (moderator), vannak.heng, emma.wilson and liam.nguyen. The full list is at /users (field username); logging in with the email works too.

A typical login flow

1. POST the form to /auth/login and store accessToken and refreshToken in secure storage (Keychain, EncryptedSharedPreferences or flutter_secure_storage). 2. Send the access token as a Bearer header on every request. 3. When a request returns 401 with token_expired, call /auth/refresh once and retry. 4. If refresh fails too, send the user back to the login screen.

Frequently asked questions

Are the tokens real JWTs?

Yes, HS256-signed JWTs you can decode on jwt.io. The secret is public, so they are only for testing.

Can I register new users?

POST /users returns a new user object, but it is not saved, so it cannot log in. Use the demo accounts.

Does logout exist?

With JWTs, logging out means deleting the tokens on the device. There is nothing to call on the server.

Why do I get 401 invalid_token?

The header must be exactly Authorization: Bearer <accessToken>. A refresh token or an edited token is rejected.

More free APIs

📚 Dictionary API 🗓️ Khmer Calendar API 🛒 Fake Store API 👥 Fake Users & Posts API 🧪 HTTP Testing API 🛰️ REST API Client

Endpoints

POST /api/v1/auth/login #

GET /api/v1/auth/me #

POST /api/v1/auth/refresh #

Demo accounts

A typical login flow

Frequently asked questions

More free APIs

POST `/api/v1/auth/login` #

GET `/api/v1/auth/me` #

POST `/api/v1/auth/refresh` #