> ## Documentation Index
> Fetch the complete documentation index at: https://ifemafia.mintlify.site/llms.txt
> Use this file to discover all available pages before exploring further.

# Session Token Authentication for the Axis API (JWT)

> Sign up or log in to receive a 7-day JWT. Include it in the Authorization header to access all protected Axis endpoints from your frontend.

Session-based authentication is the right choice for any flow where a human is behind the keyboard — account creation, dashboard access, wallet management, and developer onboarding. When you sign up or log in, Axis returns a signed JWT that is valid for **7 days**. You store that token client-side and attach it to every subsequent request via the `Authorization` header. Tokens are tied to a user account, not to any individual wallet.

***

## Sign up

**`POST /v1/auth/signup`**

Create a new Axis account. The response includes a JWT that you can use immediately — no separate login step required after registration.

When you sign up with `accountType: "business"`, Axis automatically creates a business record and returns the `businessId` in the user object. For `accountType: "developer"`, `businessId` will be `null`.

### Request body

| Field         | Type   | Required | Description                   |
| ------------- | ------ | -------- | ----------------------------- |
| `email`       | string | ✓        | A valid email address         |
| `password`    | string | ✓        | Minimum 6 characters          |
| `accountType` | string | ✓        | `"developer"` or `"business"` |

### Example

```json theme={null}
// Request
POST /v1/auth/signup
Content-Type: application/json

{
  "email": "ada@example.com",
  "password": "supersecret",
  "accountType": "developer"
}
```

```json theme={null}
// Response 201 Created
{
  "status": "success",
  "data": {
    "user": {
      "id": "a3f7c291-8b4e-4d2a-9f1c-0e5b7d3a6c82",
      "email": "ada@example.com",
      "accountType": "developer",
      "businessId": null,
      "createdAt": "2026-07-21T09:00:00.000Z"
    },
    "token": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9..."
  }
}
```

For a `"business"` signup, `businessId` will be populated rather than `null`:

```json theme={null}
// Response 201 Created (business account)
{
  "status": "success",
  "data": {
    "user": {
      "id": "b9e2d104-3c7f-4a1b-8e5d-2f0c9a4b6e31",
      "email": "ada@example.com",
      "accountType": "business",
      "businessId": "c4f1a823-7d9e-4b2c-8f0a-1e3d5c7b9a2f",
      "createdAt": "2026-07-21T09:00:00.000Z"
    },
    "token": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9..."
  }
}
```

***

## Log in

**`POST /v1/auth/login`**

Exchange credentials for a fresh JWT. Use this on returning visits after the stored token has expired or been cleared.

### Request body

```json theme={null}
// Request
POST /v1/auth/login
Content-Type: application/json

{
  "email": "ada@example.com",
  "password": "supersecret"
}
```

```json theme={null}
// Response 200 OK
{
  "status": "success",
  "data": {
    "user": {
      "id": "a3f7c291-8b4e-4d2a-9f1c-0e5b7d3a6c82",
      "email": "ada@example.com",
      "accountType": "developer",
      "businessId": null,
      "createdAt": "2026-07-21T09:00:00.000Z"
    },
    "token": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9..."
  }
}
```

***

## Log out

**`POST /v1/auth/logout`**

Invalidates the current session server-side. No request body is needed — just include your `Authorization` header as usual.

```json theme={null}
// Response 200 OK
{
  "status": "success",
  "message": "Logged out successfully"
}
```

***

## Using the token

Once you have a token, attach it to every protected request in the `Authorization` header using the `Bearer` scheme. Tokens expire after **7 days** — after expiry, the API will return `401 Unauthorized` and you will need to call `POST /v1/auth/login` again.

```typescript theme={null}
const token = localStorage.getItem("axis_token"); // or read from your auth context

const response = await fetch("https://api.axispayments.ai/api/wallets", {
  method: "GET",
  headers: {
    "Content-Type": "application/json",
    Authorization: `Bearer ${token}`,
  },
});

const data = await response.json();
```

<Warning>
  The JWT is never persisted on Axis servers after it is issued — **you are responsible for storing it client-side**. Common options are `localStorage` (simple, but exposed to XSS) or an `HttpOnly` secure cookie (more XSS-resistant). Whichever approach you choose, the token must be present on every request to a protected endpoint. If it is missing or expired, the API returns `401 Unauthorized`.
</Warning>

<Tip>
  Session tokens authenticate *users*. If you need to authenticate an autonomous agent making payment calls at runtime, use a wallet-scoped API key instead. See [API Key Auth](/guides/api-key-auth).
</Tip>