# Authentication



To create transactions on behalf of your users, you must first authenticate them. Paytrie uses a passwordless email-based authentication flow that returns a JWT token valid for 1 hour.

## Authentication flow [#authentication-flow]

<Steps>
  <Step>
    ### Send login code [#send-login-code]

    Request a login code to be sent to the user's registered
    email.
  </Step>

  <Step>
    ### User receives code [#user-receives-code]

    The user receives a 4-digit numeric code via email.
  </Step>

  <Step>
    ### Verify code [#verify-code]

    Submit the code to receive a JWT token.
  </Step>

  <Step>
    ### Use token [#use-token]

    Include the JWT token in subsequent API requests.
  </Step>
</Steps>

## Quick start [#quick-start]

<Callout type="info">
  The user must already be registered and verified through the [Customer
  Onboarding](/v2/customer-onboarding) process before they can authenticate.
</Callout>

### 1. Send login code [#1-send-login-code]

```bash
curl -X POST "https://api.paytrie.com/v2/auth/login-codes" \
  -H "x-api-key: your-api-key" \
  -H "Content-Type: application/json" \
  -d '{"email":"user@example.com"}'
```

<Card title="API Reference: Get Login Code" href="/v2/api-reference/auth/sendLoginCode" icon="arrow-right-left">
  View complete request parameters and response schema
</Card>

### 2. Verify code and get token [#2-verify-code-and-get-token]

After the user receives the 4-digit code via email:

```bash
curl -X POST "https://api.paytrie.com/v2/auth/login-codes/verify" \
  -H "x-api-key: your-api-key" \
  -H "Content-Type: application/json" \
  -d '{"email":"user@example.com","code":"1234"}'
```

The response includes a JWT token:

```json
{
  "success": true,
  "data": {
    "accessToken": "eyJhbGciOiJIUzI1NiIs...",
    "tokenType": "Bearer",
    "expiresIn": 3600
  }
}
```

<Card title="API Reference: Verify Login Code" href="/v2/api-reference/auth/verifyLoginCode" icon="arrow-right-left">
  View complete request parameters and response schema
</Card>

## Using the JWT token [#using-the-jwt-token]

Include the token in the `Authorization` header for authenticated requests:

```bash
curl -X POST "https://api.paytrie.com/v2/transactions" \
  -H "x-api-key: your-api-key" \
  -H "Authorization: Bearer eyJhbGciOiJIUzI1NiIs..." \
  -H "Content-Type: application/json" \
  -d '{...}'
```

<Callout type="warn">
  JWT tokens expire after 1 hour. If you receive an authentication error,
  request a new login code and re-authenticate the user.
</Callout>

## Knowing how you can act on a user [#knowing-how-you-can-act-on-a-user]

Users returned by the API carry an `accessibleBy` field. Your API key is required on every request regardless — this field tells you whether you also need an access token from the user:

| Value    | What to send                                                                      |
| -------- | --------------------------------------------------------------------------------- |
| `jwt`    | Your API key **and** an access token the user grants you — the flow on this page. |
| `apiKey` | Your API key on its own; no access token needed.                                  |

Every integration can use `jwt`, so it is always listed. `apiKey` appears only for integrations separately approved to act without a per-request token, and only for users who have granted that access; [contact Paytrie](/v2/support) if you think your integration needs it.