---
title: REST API – Authentication
description: "The login operation is a two-step process: obtain a token, then exchange credentials (username and access key). You can find your access key under \"My Preferences\" in the Kafinea web interface. --- ## Step 1: Get a token (getchallenge) >…"
url: "https://www.kafinea.com/en/help/api/rest-api-authentication/"
updated: "2026-04-03"
category: API
---

# REST API – Authentication

The login operation is a two-step process: obtain a token, then exchange credentials (username and access key).

You can find your access key under "My Preferences" in the Kafinea web interface.

---

## Step 1: Get a token (getchallenge)

> **GET** `https://apps.kafinea.com/{instance}/webservice.php`

| Parameter | Type | Required | Description |
| --- | --- | --- | --- |
| `operation` | string | yes | Must be `getchallenge` |
| `username` | string | yes | Kafinea username |

**Curl example:**

```bash
curl "https://apps.kafinea.com/YourKafinea/webservice.php?operation=getchallenge&username=admin"
```

**Response:**

```json
{
  "success": true,
  "result": {
    "token": "[TOKENSTRING]",
    "serverTime": "[TIMESTAMP]",
    "expireTime": "[TIMESTAMP]"
  }
}
```

---

## Step 2: Login (login)

> **POST** `https://apps.kafinea.com/{instance}/webservice.php`

| Parameter | Type | Required | Description |
| --- | --- | --- | --- |
| `operation` | string | yes | Must be `login` |
| `username` | string | yes | Kafinea username |
| `accessKey` | string | yes | `md5(token + accessKey)` — note: the K is uppercase |

**Curl example:**

```bash
curl -X POST https://apps.kafinea.com/YourKafinea/webservice.php 
  -d "operation=login" 
  -d "username=admin" 
  -d "accessKey=YOUR_MD5_HASH"
```

**Response:**

```json
{
  "success": true,
  "result": {
    "sessionId": "[STRING]",
    "userId": "[STRING]",
    "version": "[STRING]",
    "kafineaVersion": "[STRING]"
  }
}
```

---

## Logout (logout)

> **POST** `https://apps.kafinea.com/{instance}/webservice.php`

| Parameter | Type | Required | Description |
| --- | --- | --- | --- |
| `operation` | string | yes | Must be `logout` |
| `sessionName` | string | yes | Session ID obtained at login |

**Curl example:**

```bash
curl -X POST https://apps.kafinea.com/YourKafinea/webservice.php 
  -d "operation=logout" 
  -d "sessionName=YOUR_SESSION_ID"
```

---

## Extend session (extendsession)

If you need to extend your session duration, use this operation.

> **GET** `https://apps.kafinea.com/{instance}/webservice.php`

| Parameter | Type | Required | Description |
| --- | --- | --- | --- |
| `operation` | string | yes | Must be `extendsession` |

**Curl example:**

```bash
curl "https://apps.kafinea.com/YourKafinea/webservice.php?operation=extendsession"
```

---

## Related References 🔗

- [API Introduction](https://www.kafinea.com/en/documentation/api/rest-api-introduction/)
- [CRUD Operations](https://www.kafinea.com/en/documentation/api/rest-api-crud-operations/)