> ## Documentation Index
> Fetch the complete documentation index at: https://docs.qash.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Verify login code

> Verify the one-time code and receive a QASH access token for the user.

<Note>
  Requires `X-Api-Key` and `X-Api-Secret` headers. See [Authentication](/api-reference/users/introduction#authentication) for details.
</Note>

This is step 2 of the current login flow, called after [Send login code](/api-reference/users/send-otp). On success it returns a standard QASH `accessToken` — the same session token used by the QASH app itself. Every financial and card endpoint after this point uses that token, not your API key.

```
POST /partner/auth/send  →  user receives a 6-digit code by email
POST /partner/auth/verify  →  { accessToken, refreshToken }
```

## Request

```http theme={null}
POST /api/v1/partner/auth/verify
X-Api-Key: <your-api-key>
X-Api-Secret: <your-api-secret>
Content-Type: application/json
```

```json theme={null}
{
  "email": "juan@example.com",
  "code": "482913"
}
```

| Field   | Type   | Required | Description                     |
| ------- | ------ | -------- | ------------------------------- |
| `email` | string | Yes      | The email the code was sent to  |
| `code`  | string | Yes      | The 6-digit code from the email |

## Response — 200 OK

```json theme={null}
{
  "success": true,
  "accessToken": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...",
  "refreshToken": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...",
  "tokenType": "Bearer",
  "user": {
    "id": "a1b2c3d4-e5f6-7890-abcd-ef1234567890",
    "email": "juan@example.com",
    "status": "active"
  }
}
```

| Field          | Type   | Description                                                         |
| -------------- | ------ | ------------------------------------------------------------------- |
| `accessToken`  | string | Bearer token for all financial and card endpoints. Short-lived.     |
| `refreshToken` | string | Long-lived token to obtain a new `accessToken` without re-verifying |
| `user.status`  | string | Always `"active"` on a successful login                             |

<Note>
  Store `accessToken` and `refreshToken` in your backend on behalf of the user — do not expose them to client-side code unless your integration is designed to hand sessions directly to a client app.
</Note>

## Using the access token

```http theme={null}
Authorization: Bearer <accessToken>
```

From here, call [account](/api-reference/account-management/list-accounts), [financial](/api-reference/financials/introduction), and [card](/api-reference/cards/introduction) endpoints with this header — no `X-Api-Key` or `userId` needed. The token already identifies the user and your partner account.

## Errors

Failure responses share one generic message to avoid revealing account state to unauthenticated callers:

```json theme={null}
{
  "success": false,
  "error": "Invalid or expired code"
}
```

| Status | Error                         | Cause                                                                                                                                                                                       |
| ------ | ----------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `401`  | `Invalid or expired code`     | Wrong code, expired code, or the email/user does not belong to your partner scope                                                                                                           |
| `401`  | `User account is {status}`    | The user exists and the code was correct, but their status isn't `active` yet (still `pending`, `kyc_required`, `suspended`, or `banned`) — finish [KYC](/guides/partner-integration) first |
| `401`  | `Invalid partner credentials` | Wrong `X-Api-Key` or `X-Api-Secret`                                                                                                                                                         |