Skip to main content
The Partner API lets you provision end-users, run identity verification (KYC), and query account status — all from your own backend, using your own branded experience.

​
Base URL

All partner endpoints are under /api/v1/partner or /api/v1/user.

​
Authentication

There are two different credentials in this API, and each endpoint uses exactly one — never both. Before a user logs in — user registration, profile, and KYC — you authenticate with your partner credentials, and pass userId in the request body (POST/PATCH) or as a query parameter (GET):
After a user logs in — accounts, deposits, transfers, and card issuance — you authenticate with the QASH access token returned by Verify login code:
This is the same session token the QASH app itself uses. Your X-Api-Key is not sent on these calls — the token already identifies both the user and your partner account.
X-Api-Secret is shown only once at generation time. If lost, revoke the key and create a new pair from Qash Dashboard → Settings → API Keys.

​
Endpoints

​
User management — API key only

​
Login — API key in, access token out

​
User profile — API key, before login

Once the user has logged in, they can also read and update their own profile with their access token via GET/POST/PATCH /api/v1/auth/profile — the same underlying data, authenticated with Authorization: Bearer instead of your API key.

​
KYC — API key, before login

POST /api/v1/partner/auth/token was removed — it exchanged a bare userId for a JWT with no proof the request came from the user. Login is now a two-step, email-verified exchange: Send login code and Verify login code. See Exchange token for the full history.

​
Onboarding flow

​
User status lifecycle

​
Data isolation

Your API key scopes all queries — you can only see and manage users you created. A 404 on any user endpoint means either the user doesn’t exist or belongs to a different partner.

​
Credential rotation

If your X-Api-Secret is compromised:
  1. Go to Qash Dashboard → Settings → API Keys
  2. Revoke the current key
  3. Generate a new key pair
  4. Update your backend with the new credentials

​
Common errors