Login With 6-Digit PIN
Logs a user in using a 6-digit numeric PIN instead of a password.
The client must provide either email or phone_number as the identifier, plus pin.
- If
pinwas set during registration (or via a later PIN setup flow), this endpoint will verify the provided PIN using the same hashing mechanism as passwords. - On success, it returns an access token and basic user profile, similar to the email+password login.
- On repeated failures, the PIN login for that user may be temporarily locked.
Body
Login using a 6-digit PIN and an identifier (email or phone number).
6-digit numeric PIN set by the user during sign-up or via a separate PIN setup flow.
^[0-9]{6}$"123456"
User email address. Required if phone_number is not provided.
"user@example.com"
User phone number in E.164 format (e.g., +254712345678). Required if email is not provided.
"+254712345678"
Response
Login successful
Authentication response returned by login endpoints.
Short-lived PASETO bearer token used for authenticated API calls.
"v4.local.eyJzdWIiOiJ1c2VyLWlkIiwicm9sZSI6InVzZXIifQ..."
Long-lived refresh token used to obtain new access tokens. Store securely and never expose in URLs or logs.
"a1b2c3d4-e5f6-7890-abcd-ef1234567890"
Token type, typically 'bearer'.
"bearer"
Access token lifetime in seconds.
900