StatusSupportGet API keys
Access

Sign in with embed token

POST/v1/signin/embed

Authenticates a user with an embed access token. Returns a JWT access token, a refresh token, and a session object.

When the subaccount's main user has forceSubaccountSfa enabled, the caller must supply a TOTP code via the x-totp and x-totp-type headers. If the code is missing or the main user requires SFA, the gateway returns 428 with the SFA metadata needed to prompt the user; if the code is wrong, 420 is returned.

Header Parameters

x-totp?string

TOTP code required when the main account has forceSubaccountSfa enabled.

Match^[0-9]{4,6}$
x-totp-type?string

TOTP delivery method (e.g. gauth, email, sms).

Default"gauth"

Value in

  • "gauth"
  • "email"
  • "sms"
  • "call"
  • "whatsapp"

Request Body

application/json

TypeScript Definitions

Use the request body type in TypeScript.

Response Body

application/json

application/json

application/json

application/json

application/json

Sign in with embed token
curl --request POST \  --url 'https://gateway.bit2me.com/v1/signin/embed' \  --header 'Content-Type: application/json' \  --data '{  "accessToken": "header.payload.signature"}'
{  "accessToken": {    "expirationTime": 1727100000,    "token": "header.payload.signature"  },  "refreshToken": {    "expirationTime": 1727186400,    "token": "header.payload.signature"  },  "session": {    "expirationTime": 1727186400,    "id": "550e8400-e29b-41d4-a716-446655440099"  }}

Sign in with API key POST

Authenticates a user using an API key and returns a JWT access token. The API key must be sent via the `ApiKeyAuth` security scheme. The request body carries the `userId` that the key belongs to. On success the response contains an `accessToken` with its expiration timestamp.

Check and start two-factor verification GET

Checks the active two-factor authentication methods for the authenticated user and initiates the verification process. When `sfaType` is phone-based (`sms`, `call`, `whatsapp`) the service sends the OTP code immediately and returns a `retryIntervalSeconds` countdown. Optionally accepts an `operation` query parameter to scope the 2FA challenge to a specific action (e.g. withdrawal, email change).