Flutex authenticates customer contacts through the Customer API. You do not place a permanent administrator API key in the mobile app.
In Perfex, select an active customer and an active contact with a valid email and password. Enable the contact permissions needed for your test. Confirm that the API module is licensed and active.
The app sends POST /auth/login under /flutex_customer_api/v1 with the contact’s email and password. The documented response contains data.contact and data.tokens.
Token fields include access_token, refresh_token, token_type, expires_in, and refresh_expires_in. The expiry values are durations in seconds. Protected requests send:
The application stores its session securely. When appropriate, it calls POST /auth/refresh with the refresh token and stores the replacement token pair.
Refresh tokens are single-use and rotate. Reusing a consumed token revokes its session family. Do not add a second refresh mechanism or automatically repeat a refresh whose response was lost: the first request may already have succeeded.
An invalid or revoked session requires sign-in again. A temporary server or connection failure should not be treated as proof that the password or session is invalid.
For diagnosis, use the supplied API documentation and Postman collection with test credentials. Never publish tokens, passwords, or Authorization headers in support screenshots.