Mobile App Integration

The Pelcro Open API provides RESTful endpoints for mobile app integration. Use the authentication endpoints to obtain a customer JWT, then send that token in the Authorization header on protected requests.

Base URL: https://www.pelcro.com/api/v1/sdk
Full reference: Open API

# Log in, then call a protected endpoint
POST /api/v1/sdk/auth/login?site_id={site_id}
Content-Type: application/json

{ "email": "[email protected]", "password": "password" }

# The response includes data.auth_token — store it securely, then:
POST /api/v1/sdk/customer?site_id={site_id}
Authorization: Bearer {auth_token}

Prerequisites

Authentication flow

Mobile App → Register / Login → receive JWT (data.auth_token) → store securely → send as Authorization: Bearer on protected endpoints

Authentication endpoints

Site & configuration

Authentication pattern

Register a new customer

POST /api/v1/sdk/auth/register?site_id={site_id}
Content-Type: application/json

{
  "email": "[email protected]",
  "password": "securePassword123",
  "first_name": "John",
  "last_name": "Doe"
}

Success response (200): the shared Customer resource, including data.auth_token and data.token.

{
  "status": "success",
  "data": {
    "id": 1039,
    "email": "[email protected]",
    "first_name": "John",
    "last_name": "Doe",
    "auth_token": "eyJ0xxx",
    "token": "eyJ0xxx",
    "subscriptions": null,
    "addresses": null
  }
}

Log in an existing customer

POST /api/v1/sdk/auth/login?site_id={site_id}
Content-Type: application/json

{ "email": "[email protected]", "password": "securePassword123" }

Note: provide either email or username. After repeated failed attempts the account is temporarily locked, returning 400 with a "Too many login attempts" validation message (default: 10 attempts / 5-minute window, configurable per account).

The success response is the same Customer resource shape as register, with the customer's subscriptions, addresses, etc. populated.

Store the token securely

After register/login, persist data.auth_token in the platform's secure storage:

• iOS: Keychain Services
• Android: Keystore / EncryptedSharedPreferences

Make authenticated requests

Send the token in the Authorization header on protected endpoints:

PUT /api/v1/sdk/customer?site_id={site_id}
Authorization: Bearer {auth_token}
Content-Type: application/json

{ "first_name": "Jane", "last_name": "Smith" }

Log out

POST /api/v1/sdk/auth/logout?site_id={site_id}
Authorization: Bearer {auth_token}

Logout blacklists the token server-side (it can no longer be used) and returns the customer resource. Clear the token from device storage afterwards.

Token management

You can mint a fresh token without re-entering credentials via POST /customer/refresh (protected).

Response & error formats

Successful responses return JSON under a data key — either {"status":"success","data":{…}} or {"error":false,"data":…} depending on the endpoint. The shape of each object is documented in Resources.

Errors come back in one of two shapes (see Errors for the full reference):

• Validation (400) — {"errors":{"field":["message"]}}
• Application / auth — {"error":{"report_id":null,"status":404,"message":"…"}} (report_id is present on server errors)

HTTP status codes

Error examples

Validation (400):

{ "errors": { "email": ["The email has already been taken."] } }

Invalid credentials (404):

{ "error": { "report_id": null, "status": 404, "message": "Invalid credentials! Please try again." } }

Account locked (400):

{ "errors": { "email": ["Too many login attempts. Please try again later."] } }

No token provided (401):

{ "error": { "message": "Token not provided" } }

Invalid / expired token (403):

{ "error": { "status": 403, "message": "Authentication token has expired, please try again" } }

Security best practices

1. Store tokens in secure storage — iOS Keychain, Android Keystore / EncryptedSharedPreferences.
2. Never store tokens in plain text — avoid UserDefaults, SharedPreferences, or plain files.
3. Use HTTPS only and validate SSL certificates.
4. Handle expiry — on 403, clear the token and re-authenticate (or refresh proactively).
5. Clear tokens on logout — remove them from secure storage completely.
6. Never log tokens.
7. Consider certificate pinning for additional protection.

Complete reference

This guide covers the most common endpoints for mobile integration. For the full list — subscriptions, memberships, payment methods, addresses, e-commerce, and invoices — see the Open API reference.

Quick-start checklist

Additional resources

• Open API overview
• Errors
• Resources

For support, contact [email protected].