StatusSupportGet API keys
Access

Check and start two-factor verification

GET/v3/signin/sfa

Checks the active two-factor authentication methods for the authenticated user and initiates the verification process. When sfaType is phone-based (sms, call, whatsapp) the service sends the OTP code immediately and returns a retryIntervalSeconds countdown.

Optionally accepts an operation query parameter to scope the 2FA challenge to a specific action (e.g. withdrawal, email change).

Authorization

ApiKeyAuth
X-Api-Key<token>

For accessing these endpoints a valid API key must be sent in the X-Api-Key header.

In: header

Query Parameters

operation?string

Scopes the 2FA challenge to a specific action.

Value in

  • "sfa.withdrawal"
  • "sfa.emailModification"
  • "sfa.phoneModification"
  • "sfa.personalDataAccess"
  • "sfa.login"

Response Body

application/json

application/json

application/json

application/json

application/json

application/json

Check and start two-factor verification
curl --request GET \  --url 'https://gateway.bit2me.com/v3/signin/sfa'
Example1 of 2
{  "codeLength": 6,  "sfaType": "gauth"}

Sign in with embed token POST

Authenticates a user with an embed access token. Returns a JWT access token, a refresh token, and a session object. When the subaccount's main user has `forceSubaccountSfa` enabled, the caller must supply a TOTP code via the `x-totp` and `x-totp-type` headers. If the code is missing or the main user requires SFA, the gateway returns `428` with the SFA metadata needed to prompt the user; if the code is wrong, `420` is returned.

List the user's pockets, or get one GET

Returns the authenticated user's pockets, the wallet accounts that hold one asset each. A user can have several pockets of the same asset. Deleted pockets are not listed. Without `id` every pocket is returned, sorted by balance, highest first. With `id` the response is an array with that single pocket, or `404` when the user has no such pocket.