# Authentication (https://docs.loybox.com.ar/en/api-reference/autenticacion)



Sign-in for the **end user** with a one-time code sent by email. This is the
section that lets you wire Loybox directly into your website's frontend, without
going through your server.

There are no passwords: the user enters their email, receives a 6-digit code, and
that is it.

## The flow
<Steps>
  <Step>
    ### Request the code
    [`POST /v1/auth/otp/request`](https://docs.loybox.com.ar/api-reference/autenticacion/pedir-codigo) with the
    user's email. They receive a 6-digit code. The endpoint always answers `200`, even
    if that email has no account.
  </Step>

  <Step>
    ### Verify it
    [`POST /v1/auth/otp/verify`](https://docs.loybox.com.ar/api-reference/autenticacion/verificar-codigo) with
    the email and the code. It returns an access token (`access`) and a refresh token
    (`refresh`). If the email had no Loybox account, one is created; either way the
    user ends up subscribed to your commerce's program.
  </Step>

  <Step>
    ### Use the session
    From there on, calls to [My account](https://docs.loybox.com.ar/api-reference/mi-cuenta) go with the
    `Authorization: Bearer {access}` header.
  </Step>

  <Step>
    ### Renew it
    When the `access` expires,
    [`POST /v1/auth/refresh`](https://docs.loybox.com.ar/api-reference/autenticacion/renovar-token) returns a
    new one from the `refresh`, without asking the user for another code.
  </Step>
</Steps>

## Rules of the code
* It expires in **10 minutes**.
* It allows **5 attempts**.
* Requesting a new code **invalidates the previous one**.

## The X-Commerce-Id header
Every endpoint in this section and in [My account](https://docs.loybox.com.ar/api-reference/mi-cuenta)
requires the `X-Commerce-Id` header with your commerce id:

```
X-Commerce-Id: {your-commerce-id}
```

That header is what scopes the response to your program: the user never sees data
from other commerces.

<Callout type="warn" title="Do not mix up the two credentials">
  The commerce **API key** is a secret and goes on your server only. The **user's
  access token** is the one that can live in the browser. Never send the API key
  from the frontend. See [Credentials](https://docs.loybox.com.ar/api-reference/credenciales).
</Callout>

## The endpoints
<Cards>
  <Card title="Request a code" icon="Mail" description="Sends the user a 6-digit code by email." href="/api-reference/autenticacion/pedir-codigo" />

  <Card title="Verify the code" icon="BadgeCheck" description="Validates the code and returns the session tokens." href="/api-reference/autenticacion/verificar-codigo" />

  <Card title="Renew the token" icon="RefreshCw" description="A new access from the refresh, without bothering the user." href="/api-reference/autenticacion/renovar-token" />
</Cards>