Session Token Authentication for the Axis API (JWT)

Sign up or log in to receive a 7-day JWT. Include it in the Authorization header to access all protected Axis endpoints from your frontend.

Session-based authentication is the right choice for any flow where a human is behind the keyboard — account creation, dashboard access, wallet management, and developer onboarding. When you sign up or log in, Axis returns a signed JWT that is valid for 7 days. You store that token client-side and attach it to every subsequent request via the Authorization header. Tokens are tied to a user account, not to any individual wallet.

---

Sign up

POST /v1/auth/signup

Create a new Axis account. The response includes a JWT that you can use immediately — no separate login step required after registration.

When you sign up with accountType: "business", Axis automatically creates a business record and returns the businessId in the user object. For accountType: "developer", businessId will be null.

Request body

Field	Type	Required	Description
email	string	✓	A valid email address
password	string	✓	Minimum 6 characters
accountType	string	✓	"developer" or "business"

Example

// Request
POST /v1/auth/signup
Content-Type: application/json

{
  "email": "[e-mail]",
  "password": "supersecret",
  "accountType": "developer"
}

// Response 201 Created
{
  "status": "success",
  "data": {
    "user": {
      "id": "a3f7c291-8b4e-4d2a-9f1c-0e5b7d3a6c82",
      "email": "[e-mail]",
      "accountType": "developer",
      "businessId": null,
      "createdAt": "2026-07-21T09:00:00.000Z"
    },
    "token": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9..."
  }
}

For a "business" signup, businessId will be populated rather than null:

// Response 201 Created (business account)
{
  "status": "success",
  "data": {
    "user": {
      "id": "b9e2d104-3c7f-4a1b-8e5d-2f0c9a4b6e31",
      "email": "[e-mail]",
      "accountType": "business",
      "businessId": "c4f1a823-7d9e-4b2c-8f0a-1e3d5c7b9a2f",
      "createdAt": "2026-07-21T09:00:00.000Z"
    },
    "token": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9..."
  }
}

---

Log in

POST /v1/auth/login

Exchange credentials for a fresh JWT. Use this on returning visits after the stored token has expired or been cleared.

Request body

// Request
POST /v1/auth/login
Content-Type: application/json

{
  "email": "[e-mail]",
  "password": "supersecret"
}

// Response 200 OK
{
  "status": "success",
  "data": {
    "user": {
      "id": "a3f7c291-8b4e-4d2a-9f1c-0e5b7d3a6c82",
      "email": "[e-mail]",
      "accountType": "developer",
      "businessId": null,
      "createdAt": "2026-07-21T09:00:00.000Z"
    },
    "token": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9..."
  }
}

---

Log out

POST /v1/auth/logout

Invalidates the current session server-side. No request body is needed — just include your Authorization header as usual.

// Response 200 OK
{
  "status": "success",
  "message": "Logged out successfully"
}

---

Using the token

Once you have a token, attach it to every protected request in the Authorization header using the Bearer scheme. Tokens expire after 7 days — after expiry, the API will return 401 Unauthorized and you will need to call POST /v1/auth/login again.

const token = localStorage.getItem("axis_token"); // or read from your auth context

const response = await fetch("https://api.axispayments.ai/api/wallets", {
  method: "GET",
  headers: {
    "Content-Type": "application/json",
    Authorization: `Bearer ${token}`,
  },
});

const data = await response.json();

The JWT is never persisted on Axis servers after it is issued — you are responsible for storing it client-side. Common options are localStorage (simple, but exposed to XSS) or an HttpOnly secure cookie (more XSS-resistant). Whichever approach you choose, the token must be present on every request to a protected endpoint. If it is missing or expired, the API returns 401 Unauthorized.

Session tokens authenticate users. If you need to authenticate an autonomous agent making payment calls at runtime, use a wallet-scoped API key instead. See API Key Auth.