User login
curl --request POST \
--url https://api.qash.ai/api/v1/partner/auth/login \
--header 'Content-Type: application/json' \
--header 'X-Api-Key: <api-key>' \
--header 'X-Api-Secret: <api-key>' \
--data '
{
"privyToken": "eyJhbGciOiJFUzI1NiIsInR5cCI6IkpXVCJ9..."
}
'const options = {
method: 'POST',
headers: {
'X-Api-Key': '<api-key>',
'X-Api-Secret': '<api-key>',
'Content-Type': 'application/json'
},
body: JSON.stringify({privyToken: 'eyJhbGciOiJFUzI1NiIsInR5cCI6IkpXVCJ9...'})
};
fetch('https://api.qash.ai/api/v1/partner/auth/login', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));import requests
url = "https://api.qash.ai/api/v1/partner/auth/login"
payload = { "privyToken": "eyJhbGciOiJFUzI1NiIsInR5cCI6IkpXVCJ9..." }
headers = {
"X-Api-Key": "<api-key>",
"X-Api-Secret": "<api-key>",
"Content-Type": "application/json"
}
response = requests.post(url, json=payload, headers=headers)
print(response.text){
"success": true,
"user": {
"id": "550e8400-e29b-41d4-a716-446655440000",
"email": "user@example.com",
"status": "active",
"userType": "personal",
"roles": [],
"beta": false,
"delegated": false
},
"accessToken": "eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9...",
"refreshToken": "eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9...",
"isNewUser": false,
"businessId": "bp-uuid-del-partner"
}
Login
User login (deprecated)
deprecated
Exchange a Privy token for QASH access and refresh tokens.
POST
/
api
/
v1
/
partner
/
auth
/
login
User login
curl --request POST \
--url https://api.qash.ai/api/v1/partner/auth/login \
--header 'Content-Type: application/json' \
--header 'X-Api-Key: <api-key>' \
--header 'X-Api-Secret: <api-key>' \
--data '
{
"privyToken": "eyJhbGciOiJFUzI1NiIsInR5cCI6IkpXVCJ9..."
}
'const options = {
method: 'POST',
headers: {
'X-Api-Key': '<api-key>',
'X-Api-Secret': '<api-key>',
'Content-Type': 'application/json'
},
body: JSON.stringify({privyToken: 'eyJhbGciOiJFUzI1NiIsInR5cCI6IkpXVCJ9...'})
};
fetch('https://api.qash.ai/api/v1/partner/auth/login', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));import requests
url = "https://api.qash.ai/api/v1/partner/auth/login"
payload = { "privyToken": "eyJhbGciOiJFUzI1NiIsInR5cCI6IkpXVCJ9..." }
headers = {
"X-Api-Key": "<api-key>",
"X-Api-Secret": "<api-key>",
"Content-Type": "application/json"
}
response = requests.post(url, json=payload, headers=headers)
print(response.text){
"success": true,
"user": {
"id": "550e8400-e29b-41d4-a716-446655440000",
"email": "user@example.com",
"status": "active",
"userType": "personal",
"roles": [],
"beta": false,
"delegated": false
},
"accessToken": "eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9...",
"refreshToken": "eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9...",
"isNewUser": false,
"businessId": "bp-uuid-del-partner"
}
Deprecated — This endpoint requires partners to integrate the Privy SDK directly in their frontend or mobile app, which is not the recommended integration path.Use Send login code and Verify login code instead — a backend-only email OTP login with no SDK dependency, entirely from your own servers.
Requires
X-Api-Key and X-Api-Secret headers. See Authentication for details.privyToken to Qash to receive a QASH accessToken and refreshToken.
- If the user was pre-registered with
POST /users, their Privy account is automatically linked on first login. - The
accessTokenexpires in ~24 hours (configurable server-side viaJWT_EXPIRES_IN). UserefreshToken(valid 30 days) to obtain a new one. - The
businessIdin the response is derived server-side from your API key — never send it from the client. isNewUser: trueindicates this is the user’s first login.
Authorizations
Partner API key. Generated from Qash Dashboard → Settings → API Keys.
Partner API secret. Shown once at creation — store it securely.
Body
application/json
Privy token from the user's authentication session.
JWT issued by Privy after the user authenticates in your app.
Minimum string length:
1Example:
"eyJhbGciOiJFUzI1NiIsInR5cCI6IkpXVCJ9..."
Response
User authenticated successfully.
Example:
true
Hide child attributes
Hide child attributes
Current lifecycle status of the user.
Available options:
pending, active, suspended, banned Available options:
personal, business Short-lived JWT (~1 hour) for authenticated user requests.
Long-lived JWT (30 days) to obtain new access tokens.
true if this is the user's first login.
Business profile ID of the partner, derived server-side from the API key.