Authentication
End-user sign-in with a one-time code sent by email, to wire Loybox straight into your website.
Sign-in for the end user with a one-time code sent by email. This is the section that lets you wire Loybox directly into your website's frontend, without going through your server.
There are no passwords: the user enters their email, receives a 6-digit code, and that is it.
The flow
Request the code
POST /v1/auth/otp/request with the
user's email. They receive a 6-digit code. The endpoint always answers 200, even
if that email has no account.
Verify it
POST /v1/auth/otp/verify with
the email and the code. It returns an access token (access) and a refresh token
(refresh). If the email had no Loybox account, one is created; either way the
user ends up subscribed to your commerce's program.
Use the session
From there on, calls to My account go with the
Authorization: Bearer {access} header.
Renew it
When the access expires,
POST /v1/auth/refresh returns a
new one from the refresh, without asking the user for another code.
Rules of the code
- It expires in 10 minutes.
- It allows 5 attempts.
- Requesting a new code invalidates the previous one.
The X-Commerce-Id header
Every endpoint in this section and in My account
requires the X-Commerce-Id header with your commerce id:
X-Commerce-Id: {your-commerce-id}That header is what scopes the response to your program: the user never sees data from other commerces.
Do not mix up the two credentials
The commerce API key is a secret and goes on your server only. The user's access token is the one that can live in the browser. Never send the API key from the frontend. See Credentials.