Skip to main content
Every PropOps API endpoint requires authentication. The platform supports two authentication methods depending on your client type.
Browser clients authenticate automatically via session cookies set at login. No additional configuration is needed — the browser sends the session cookie on every request.Session lifetimes:
Session typeDuration
Web browser (active)2 hours
Web browser (idle)30 minutes
Remember Me30 days
Cookies are set with HttpOnly, Secure (HTTPS only), and SameSite=Lax flags to prevent JavaScript access and cross-site request forgery.

​
CSRF tokens

State-changing requests — POST, PUT, and DELETE — require a valid CSRF token in addition to your session or Bearer token. This protects against cross-site request forgery attacks.

​
Get a token

GET /api/security/csrf-token
Response
{
  "success": true,
  "data": {
    "token": "abc123def456..."
  },
  "message": "CSRF token issued"
}

​
Send the token

Pass the CSRF token in any one of these locations:
LocationKey
JSON request bodycsrf_token
Form field or POST parametercsrf_token
HTTP request headerX-CSRF-Token
curl -X POST https://propops.yourcompany.com/api/jobs/manage \
  -H "Authorization: Bearer <your-token>" \
  -H "X-CSRF-Token: abc123def456..." \
  -H "Content-Type: application/json" \
  -d '{ "title": "Boiler repair", "priority": "high" }'
CSRF tokens are single-use and session-scoped. Fetch a fresh token for each state-changing operation or at the start of each user session.

​
Permissions

Access to each endpoint is controlled by a granular permission key in dot-notation, for example api.jobs.manage.manage. Your account inherits permissions from the role your administrator assigns to you. If you call an endpoint your role does not have permission for, you receive 403 Forbidden: 
{
  "success": false,
  "error": "You do not have permission to perform this action"
}
To see your resolved permissions, call: 
GET /api/users/permissions
Contact your PropOps administrator to request additional permissions for your role.