# Authentication



To create transactions on behalf of your users, you must first authenticate them. Paytrie uses a passwordless email-based authentication flow that returns a JWT token valid for 1 hour.

## Authentication flow [#authentication-flow]

<Steps>
  <Step>
    ### Send login code [#send-login-code]

    Request a login code to be sent to the user's registered
    email.
  </Step>

  <Step>
    ### User receives code [#user-receives-code]

    The user receives a 4-digit numeric code via email.
  </Step>

  <Step>
    ### Verify code [#verify-code]

    Submit the code to receive a JWT token.
  </Step>

  <Step>
    ### Use token [#use-token]

    Include the JWT token in subsequent API requests.
  </Step>
</Steps>

## Quick start [#quick-start]

<Callout type="info">
  The user must already be registered and verified through the [Customer
  Onboarding](/v2/customer-onboarding) process before they can authenticate.
</Callout>

### 1. Send login code [#1-send-login-code]

```bash
curl -X POST "https://api.paytrie.com/v2/auth/login-codes" \
  -H "x-api-key: your-api-key" \
  -H "Content-Type: application/json" \
  -d '{"email":"user@example.com"}'
```

<Card title="API Reference: Get Login Code" href="/v2/api-reference/auth/sendLoginCode" icon="arrow-right-left">
  View complete request parameters and response schema
</Card>

### 2. Verify code and get token [#2-verify-code-and-get-token]

After the user receives the 4-digit code via email:

```bash
curl -X POST "https://api.paytrie.com/v2/auth/login-codes/verify" \
  -H "x-api-key: your-api-key" \
  -H "Content-Type: application/json" \
  -d '{"email":"user@example.com","code":"1234"}'
```

The response includes a JWT token:

```json
{
  "success": true,
  "data": {
    "accessToken": "eyJhbGciOiJIUzI1NiIs...",
    "tokenType": "Bearer",
    "expiresIn": 3600
  }
}
```

<Card title="API Reference: Verify Login Code" href="/v2/api-reference/auth/verifyLoginCode" icon="arrow-right-left">
  View complete request parameters and response schema
</Card>

## Using the JWT token [#using-the-jwt-token]

Include the token in the `Authorization` header for authenticated requests:

```bash
curl -X POST "https://api.paytrie.com/v2/transactions" \
  -H "x-api-key: your-api-key" \
  -H "Authorization: Bearer eyJhbGciOiJIUzI1NiIs..." \
  -H "Content-Type: application/json" \
  -d '{...}'
```

<Callout type="warn">
  JWT tokens expire after 1 hour. If you receive an authentication error,
  request a new login code and re-authenticate the user.
</Callout>