Authentication
Every user type — customer, driver, business, company, and admin — authenticates the same way: identifier + password, followed by an OTP sent to the account's phone number. There is no API-key auth today; every request carries a JWT access token.
1. Log in with credentials
POST /auth/login
{
"identifier": "[email protected]",
"password": "••••••••",
"rememberMe": true
}Response — an OTP is sent to the account's phone number:
{
"success": true,
"sessionId": "3f2504e0-4f89-...",
"phone": "+2348012345678",
"message": "OTP sent to your phone number"
}2. Verify the OTP
POST /auth/login/verify-otp
{
"sessionId": "3f2504e0-4f89-...",
"phone": "+2348012345678",
"code": "482913"
}Response:
{
"success": true,
"accessToken": "eyJhbGciOiJIUzI1NiIs...",
"refreshToken": "9b1deb4d-3b7d-...",
"user": {
"id": "...",
"email": "[email protected]",
"phone": "+2348012345678",
"firstName": "Ada",
"lastName": "Owner",
"role": "BUSINESS",
"isEmailVerified": true,
"isPhoneVerified": true
}
}Didn't get a code? Call POST /auth/login/send-otp with the same sessionId and phone to resend it.
3. Use the access token
Send it as a Bearer token on every authenticated request:
Authorization: Bearer eyJhbGciOiJIUzI1NiIs...4. Refresh an expired token
POST /auth/refresh
{ "refreshToken": "9b1deb4d-3b7d-..." }{ "success": true, "accessToken": "eyJhbGciOiJIUzI1NiIs..." }5. Log out
Invalidates the refresh token server-side.
POST /auth/logout
{ "refreshToken": "9b1deb4d-3b7d-..." }