Skip to main content

Documentation Index

Fetch the complete documentation index at: https://docs.dubupay.com/llms.txt

Use this file to discover all available pages before exploring further.

This endpoint authenticates your merchant account and returns two tokens: a short-lived access token you attach to every API request, and a long-lived refresh token you store securely and use only to rotate the access token when it expires. Your account must have a verified email address before login succeeds. This endpoint applies a strict rate limit.

​
Endpoint

POST https://api.dubupay.com/api/v1/auth/login
No authentication is required.

​
Request body

​
email
string
required
The email address registered to your merchant account.
​
password
string
required
Your account password.

​
Response

HTTP 200 OK on success.
​
success
boolean
true on a successful login.
​
data
object

​
Example

curl -X POST https://api.dubupay.com/api/v1/auth/login \
  -H "Content-Type: application/json" \
  -d '{
    "email": "owner@acmetrading.com",
    "password": "SuperSecret123"
  }'
Response 
{
  "success": true,
  "data": {
    "access_token": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...",
    "refresh_token": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...",
    "merchant": {
      "id": "a1b2c3d4-e5f6-7890-abcd-ef1234567890",
      "business_name": "Acme Trading Ltd",
      "email": "owner@acmetrading.com",
      "is_verified": true,
      "is_active": true,
      "kyc_status": "PENDING",
      "personal_kyc_status": "PENDING",
      "country": null
    }
  }
}

​
Using the access token

Pass the access token in the Authorization header on every authenticated request: 
curl https://api.dubupay.com/api/v1/auth/me \
  -H "Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9..."
Access tokens expire after 15 minutes. When you receive a 401 UNAUTHORIZED response on a previously working token, call POST /auth/refresh with your refresh token to get a new access token.

​
Token lifetimes

TokenLifetimeWhere to store
Access token15 minutesIn-memory only. Do not persist to disk or localStorage.
Refresh token7 daysSecure, HTTP-only cookie or encrypted storage. Never expose it to client-side JavaScript.

​
Error responses

StatusCodeDescription
400Validation erroremail or password is missing or malformed.
401INVALID_CREDENTIALSEmail/password combination is incorrect, or the account is not active.
429Rate limitToo many login attempts. Wait before retrying.