Authentication

Authenticate and manage JWT tokens.

After a successful login, save:

• access_token — used for all subsequent API calls (Authorization: Bearer <token>)
• expires_in — used to know when to refresh (default 36,000 seconds ~ 10 hours)
• refresh_token — used to get a new access_token without logging in again (expires after 1,800 seconds ~ 30 minutes)