2. Sign in (WhatsApp)

Individual sign-in takes two calls: the phone number, then the 6-digit code received on WhatsApp.

Request the WhatsApp code

POST/auth/login/phonePublic

Sends a 6-digit code by WhatsApp to the account's number. Individual accounts only.

Request body
{
  "phone": "696246686"
}
Response 200
{
  "success": true,
  "data": {
    "requires_whatsapp_otp": true,
    "challenge_token": "550e8400-e29b-41d4-a716-446655440000"
  },
  "meta": {
    "request_id": "...",
    "timestamp": "..."
  }
}
CodeWhen
422Unknown number, business account (use email sign-in), disabled account, or WhatsApp delivery failed.

Validate the code and get the token

POST/auth/whatsapp-otp/challengePublic

Validates the code received. The challenge_token is single-use and expires after 5 minutes.

Request body
{
  "challenge_token": "550e8400-e29b-41d4-a716-446655440000",
  "code": "123456"
}
Response 200
{
  "success": true,
  "data": {
    "merchant": {
      "id": 1,
      "name": "Nom Prénom",
      "merchant_type": "individual",
      "kyc_status": "none"
    },
    "token": "<jeton-de-session>",
    "token_type": "Bearer"
  },
  "meta": {
    "request_id": "...",
    "timestamp": "..."
  }
}
CodeWhen
422Invalid code, expired or already used challenge: restart the previous step.
  • Keep token: it is the session token for the next steps (Authorization: Bearer {token}).
  • Sign out: POST /auth/logout.