Authentication

To create transactions on behalf of your users, you must first authenticate them. Paytrie uses a passwordless email-based authentication flow that returns a JWT token valid for 1 hour.

Authentication flow

Quick start

1. Send login code

curl -X POST "https://api.paytrie.com/v2/auth/login-codes" \
  -H "x-api-key: your-api-key" \
  -H "Content-Type: application/json" \
  -d '{"email":"user@example.com"}'

2. Verify code and get token

After the user receives the 4-digit code via email:

curl -X POST "https://api.paytrie.com/v2/auth/login-codes/verify" \
  -H "x-api-key: your-api-key" \
  -H "Content-Type: application/json" \
  -d '{"email":"user@example.com","code":"1234"}'

The response includes a JWT token:

{
  "success": true,
  "data": {
    "accessToken": "eyJhbGciOiJIUzI1NiIs...",
    "tokenType": "Bearer",
    "expiresIn": 3600
  }
}

Using the JWT token

Include the token in the Authorization header for authenticated requests:

curl -X POST "https://api.paytrie.com/v2/transactions" \
  -H "x-api-key: your-api-key" \
  -H "Authorization: Bearer eyJhbGciOiJIUzI1NiIs..." \
  -H "Content-Type: application/json" \
  -d '{...}'

Knowing how you can act on a user

Users returned by the API carry an accessibleBy field. Your API key is required on every request regardless — this field tells you whether you also need an access token from the user:

Every integration can use jwt, so it is always listed. apiKey appears only for integrations separately approved to act without a per-request token, and only for users who have granted that access; contact Paytrie if you think your integration needs it.