User login (deprecated)

User login

curl --request POST \
  --url https://api.qash.ai/api/v1/partner/auth/login \
  --header 'Content-Type: application/json' \
  --header 'X-Api-Key: <api-key>' \
  --header 'X-Api-Secret: <api-key>' \
  --data '
{
  "privyToken": "eyJhbGciOiJFUzI1NiIsInR5cCI6IkpXVCJ9..."
}
'

const options = {
  method: 'POST',
  headers: {
    'X-Api-Key': '<api-key>',
    'X-Api-Secret': '<api-key>',
    'Content-Type': 'application/json'
  },
  body: JSON.stringify({privyToken: 'eyJhbGciOiJFUzI1NiIsInR5cCI6IkpXVCJ9...'})
};

fetch('https://api.qash.ai/api/v1/partner/auth/login', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

import requests

url = "https://api.qash.ai/api/v1/partner/auth/login"

payload = { "privyToken": "eyJhbGciOiJFUzI1NiIsInR5cCI6IkpXVCJ9..." }
headers = {
    "X-Api-Key": "<api-key>",
    "X-Api-Secret": "<api-key>",
    "Content-Type": "application/json"
}

response = requests.post(url, json=payload, headers=headers)

print(response.text)

{
  "success": true,
  "user": {
    "id": "550e8400-e29b-41d4-a716-446655440000",
    "email": "user@example.com",
    "status": "active",
    "userType": "personal",
    "roles": [],
    "beta": false,
    "delegated": false
  },
  "accessToken": "eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9...",
  "refreshToken": "eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9...",
  "isNewUser": false,
  "businessId": "bp-uuid-del-partner"
}

POST

api

partner

auth

User login

curl --request POST \
  --url https://api.qash.ai/api/v1/partner/auth/login \
  --header 'Content-Type: application/json' \
  --header 'X-Api-Key: <api-key>' \
  --header 'X-Api-Secret: <api-key>' \
  --data '
{
  "privyToken": "eyJhbGciOiJFUzI1NiIsInR5cCI6IkpXVCJ9..."
}
'

const options = {
  method: 'POST',
  headers: {
    'X-Api-Key': '<api-key>',
    'X-Api-Secret': '<api-key>',
    'Content-Type': 'application/json'
  },
  body: JSON.stringify({privyToken: 'eyJhbGciOiJFUzI1NiIsInR5cCI6IkpXVCJ9...'})
};

fetch('https://api.qash.ai/api/v1/partner/auth/login', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

import requests

url = "https://api.qash.ai/api/v1/partner/auth/login"

payload = { "privyToken": "eyJhbGciOiJFUzI1NiIsInR5cCI6IkpXVCJ9..." }
headers = {
    "X-Api-Key": "<api-key>",
    "X-Api-Secret": "<api-key>",
    "Content-Type": "application/json"
}

response = requests.post(url, json=payload, headers=headers)

print(response.text)

{
  "success": true,
  "user": {
    "id": "550e8400-e29b-41d4-a716-446655440000",
    "email": "user@example.com",
    "status": "active",
    "userType": "personal",
    "roles": [],
    "beta": false,
    "delegated": false
  },
  "accessToken": "eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9...",
  "refreshToken": "eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9...",
  "isNewUser": false,
  "businessId": "bp-uuid-del-partner"
}

Deprecated — This endpoint requires partners to integrate the Privy SDK directly in their frontend or mobile app, which is not the recommended integration path.Use Send login code and Verify login code instead — a backend-only email OTP login with no SDK dependency, entirely from your own servers.

Requires X-Api-Key and X-Api-Secret headers. See Authentication for details.

Call this endpoint after the user authenticates in your app via Privy (email OTP, wallet, etc.). Pass the resulting privyToken to Qash to receive a QASH accessToken and refreshToken.

If the user was pre-registered with POST /users, their Privy account is automatically linked on first login.
The accessToken expires in ~24 hours (configurable server-side via JWT_EXPIRES_IN). Use refreshToken (valid 30 days) to obtain a new one.
The businessId in the response is derived server-side from your API key — never send it from the client.
isNewUser: true indicates this is the user’s first login.

Authorizations

X-Api-Key

string

header

required

Partner API key. Generated from Qash Dashboard → Settings → API Keys.

X-Api-Secret

string

header

required

Partner API secret. Shown once at creation — store it securely.

Body

application/json

Privy token from the user's authentication session.

privyToken

string

required

JWT issued by Privy after the user authenticates in your app.

Minimum string length: 1

Example:

"eyJhbGciOiJFUzI1NiIsInR5cCI6IkpXVCJ9..."

Response

User authenticated successfully.

success

boolean

required

Example:

true

user

object

required

Hide child attributes

user.id

string<uuid>

required

user.email

string<email>

required

user.status

enum<string>

required

Current lifecycle status of the user.

Available options:

pending,

active,

suspended,

banned

user.userType

enum<string>

required

Available options:

personal,

business

user.roles

string[]

required

user.beta

boolean

required

user.delegated

boolean

required

accessToken

string

required

Short-lived JWT (~1 hour) for authenticated user requests.

refreshToken

string

required

Long-lived JWT (30 days) to obtain new access tokens.

isNewUser

boolean

required

true if this is the user's first login.

businessId

string<uuid>

required

Business profile ID of the partner, derived server-side from the API key.

Exchange rates / TRM

Cards

Users

Login

User profile

KYC

Account Management

Financials

Authorizations

Body

Response