Obtain a JWT bearer token with your OptoSoft credentials, then read the signed-in user's profile and daily working context.
3 endpoints in this module. Every request needs a JWT bearer token — see Authentication.
Every OptoSoft API call is authenticated with a JWT bearer token. You obtain one by
posting your OptoSoft credentials to the login endpoint, then send it in the
Authorization header on every subsequent request.
The two account endpoints let you confirm which user, company and branch a token actually resolves to — useful on start-up, and for showing the operator’s name and store in your own interface.
Cache the token, do not re-login per request. Request a token once
when your process starts, reuse it, and only call login again when a request comes
back 401. Repeated logins are the most common
cause of throttling complaints.
Exchanges an OptoSoft username and password for a JWT bearer token. This is the only endpoint you can call without an existing token.
| Field | Type | Required | Description |
|---|---|---|---|
| userName | string | Required | Your OptoSoft login name, as used in the OptoSoft web application. |
| password | string | Required | The matching password. Sent over HTTPS only. |
curl -X POST https://api.opto-soft.com/api/Auth/login \
-H "Content-Type: application/json" \
-d '{
"userName": "storeadmin",
"password": "your-password"
}'{
"token": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...",
"userId": 1042,
"companyID": 18,
"branchID": 24
}
The exact response shape is not declared in the OpenAPI specification, which
types this response simply as 200 OK. The
example above reflects the fields the OptoSoft clients consume. Read the token
defensively and ignore any properties you do not recognise.
| Status | Cause |
|---|---|
| 400 | Missing userName or password. |
| 401 | Credentials rejected, or the account is inactive. |
Returns the profile of the user the bearer token belongs to — name, role, and the company and branch the token is scoped to. Takes no request body; the user is resolved entirely from the token.
Call this once after login to discover the companyID
and branchID you must pass to the search and save
endpoints, rather than hard-coding them.
None. Send an empty POST with the Authorization header.
curl -X POST https://api.opto-soft.com/api/Account/get-profile \
-H "Authorization: Bearer YOUR_TOKEN" \
-H "Content-Length: 0"| Status | Cause |
|---|---|
| 401 | Token missing, malformed or expired. |
Returns the signed-in user’s working context for a given business date — typically the active financial year, branch defaults and counters used to initialise a POS session.
| Name | Type | Required | Description |
|---|---|---|---|
| date | string | Optional | Business date to resolve the context against. Omit to use today. Send as YYYY-MM-DD. |
curl "https://api.opto-soft.com/api/Account/user-details?date=2026-07-26" \
-H "Authorization: Bearer YOUR_TOKEN"| Status | Cause |
|---|---|
| 400 | date is present but not a parseable date. |
| 401 | Token missing, malformed or expired. |
With a token in hand, the usual next step is to look up or create the customer, then attach a prescription and raise an order. See Customers & Prescriptions and Sales Orders, or read the API overview for conventions that apply across every module.