Login

POST /openapi/v1/auth/login

Authenticate the partner system identity. Receive a JWT set (Access Token + Refresh Token).

Payload before encryption:

{
  "username": "[email protected]",
  "password": "Password#123",
  "client_id": "fMLgZltRRtetnsOHXgxsHQ",
  "client_secret": "hUFhGJIqz746zcxsYVtrwhkveDuEfcYd"
}

Field	Required	Description
username	✅	Login email
password	✅	Password
client_id	✅	Application ID (provided by TCONNECT)
client_secret	✅	Application secret (provided by TCONNECT)

cURL

curl --location '<base_url>/openapi/v1/auth/login' \
  --header 'Partner-Code: YOUR_PARTNER_CODE' \
  --header 'Content-Type: application/json' \
  --data '{
  "data": ENCRYPTED_PAYLOAD
}'

Python

import requests

url = "<base_url>/openapi/v1/auth/login"

payload = {"data": "ENCRYPTED_PAYLOAD"}
headers = {
    "Partner-Code": "YOUR_PARTNER_CODE",
    "Content-Type": "application/json",
}

response = requests.post(url, headers=headers, json=payload)
print(response.text)

Go

package main

import (
	"fmt"
	"io"
	"net/http"
	"strings"
)

func main() {
	url := "<base_url>/openapi/v1/auth/login"
	body := strings.NewReader(`{"data":"ENCRYPTED_PAYLOAD"}`)

	req, _ := http.NewRequest("POST", url, body)
	req.Header.Set("Partner-Code", "YOUR_PARTNER_CODE")
	req.Header.Set("Content-Type", "application/json")

	resp, _ := http.DefaultClient.Do(req)
	defer resp.Body.Close()

	result, _ := io.ReadAll(resp.Body)
	fmt.Println(string(result))
}

JavaScript

const response = await fetch("<base_url>/openapi/v1/auth/login", {
  method: "POST",
  headers: {
    "Partner-Code": "YOUR_PARTNER_CODE",
    "Content-Type": "application/json",
  },
  body: JSON.stringify({ data: "ENCRYPTED_PAYLOAD" }),
});

const result = await response.text();
console.log(result);

Request

Headers

Name	Required	Description
Partner-Code	✅	Merchant identifier code (provided by TCONNECT)
Content-Type	✅	application/json

Body

Field	Type	Required	Description
data	string	✅	AES-256-CBC encrypted payload as Hexadecimal

Response

200 — Login successful

Field	Type	Description
access_token	string	JWT used to authenticate requests. Add to header Authorization: Bearer <token>
expires_in	integer	access_token lifetime in seconds
refresh_token	string	Long-lived token used to get a new access_token when it expires
refresh_expires_in	integer	refresh_token lifetime in seconds
token_type	string	Always "Bearer"
session_state	string	UUID of the session on the authentication server
scope	string	List of granted permissions