Documentation Index
Fetch the complete documentation index at: /llms.txt
Use this file to discover all available pages before exploring further.
Exchange your email and password for a short-lived access token and a long-lived refresh token. Use the access token to authenticate all subsequent API requests.
POST https://api.dubupay.com/api/v1/auth/login
200 OK on success.
true on a successful login.Show data
Authorization: Bearer header on all authenticated requests.POST /auth/refresh to get a new access token without re-entering your password. Store it securely — treat it like a password.Show merchant
curl -X POST https://api.dubupay.com/api/v1/auth/login \
-H "Content-Type: application/json" \
-d '{
"email": "owner@acmetrading.com",
"password": "SuperSecret123"
}'
{
"success": true,
"data": {
"access_token": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...",
"refresh_token": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...",
"merchant": {
"id": "a1b2c3d4-e5f6-7890-abcd-ef1234567890",
"business_name": "Acme Trading Ltd",
"email": "owner@acmetrading.com",
"is_verified": true,
"is_active": true,
"kyc_status": "PENDING",
"personal_kyc_status": "PENDING",
"country": null
}
}
}
Authorization header on every authenticated request:
curl https://api.dubupay.com/api/v1/auth/me \
-H "Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9..."
401 UNAUTHORIZED response on a previously working token, call POST /auth/refresh with your refresh token to get a new access token.
| Token | Lifetime | Where to store |
|---|---|---|
| Access token | 15 minutes | In-memory only. Do not persist to disk or localStorage. |
| Refresh token | 7 days | Secure, HTTP-only cookie or encrypted storage. Never expose it to client-side JavaScript. |
| Status | Code | Description |
|---|---|---|
400 | Validation error | email or password is missing or malformed. |
401 | INVALID_CREDENTIALS | Email/password combination is incorrect, or the account is not active. |
429 | Rate limit | Too many login attempts. Wait before retrying. |