Authentication

The SDK does not replace your login screen. Your app authenticates users; the SDK only needs a User JWT at connect time.

Two credentials, two purposes

Credential	Purpose	Created by	Used in
SDK API Key	Identifies your app to the Azeoo backend	Azeoo team	initialize(apiKey)
User JWT	Identifies the logged-in user	Your backend (signed with SDK Secret Key)	connect(token, ...)

Full guide

For the JWT payload spec, signing instructions, and backend code examples, see Creating the User JWT.

Flow

What you pass at connect

Field	Required	Source
token	Yes	Your backend — see Creating the User JWT
gender	Yes	Your user profile
height	Yes	Measurements
weight	Yes	Measurements

Do not pass userId

The Azeoo user id is returned in the connect response / AzeooSDK.userId (Flutter). Do not send your own id as a separate connect parameter. The user id goes inside the JWT payload.

Where the JWT comes from

Your backend creates and signs it. See Creating the User JWT for the payload spec, HS256 signing instructions, and code examples in Node.js, Python, and PHP.

Internal Azeoo apps (native auth token)

Applies to very few integrators

Most SDK clients are not affected. Read this section only if the Azeoo team configured your SDK API key for the internal native-app flow.

The standard flow above applies to external integrators: your backend must mint a short-lived User JWT (signed with the SDK Secret Key and the predefined payload) and your app passes it to connect / connectUser.

A small set of internal Azeoo apps — native mobile clients that already authenticate users against the Azeoo server — may use an SDK API key that accepts the existing native app client authentication token directly in the token parameter. In that case:

• You do not need a backend endpoint to create a User JWT with the predefined payload.
• After login, pass the same client auth token your app already uses for Azeoo API calls into connect / connectUser, along with gender, height, and weight.
• The Azeoo server validates that token and resolves the user for the SDK session.

The SDK call signature is unchanged — only the meaning of token differs for these keys. If you are unsure whether your API key supports this mode, contact the Azeoo team. Third-party integrators should always use the standard User JWT flow.

Token refresh

• The SDK stores tokens needed for API calls after connect.
• If your JWT expires, obtain a new token from your backend and call connect again (or disconnect then connect).
• Configure refresh in your app before handing a fresh JWT to the SDK.

Logout

// Flutter
await AzeooSDK.disconnect();

// Android
AzeooSDK.shared.disconnect { }

// iOS
AzeooSDK.shared.disconnect { }

After disconnect, nutrition/training UI must not be shown until you connect again.

Full app reset (native)

If you need to tear down the Flutter engine (e.g. switch API keys):

• Android / iOS: dispose() then initialize() again
• Flutter: typically disconnect() is enough; re-init is host-specific

Next steps

• Creating the User JWT — payload, signing, backend code
• Measurements
• Glossary
• Integration checklist