Session-based authentication is the right choice for any flow where a human is behind the keyboard — account creation, dashboard access, wallet management, and developer onboarding. When you sign up or log in, Axis returns a signed JWT that is valid for 7 days. You store that token client-side and attach it to every subsequent request via the Authorization header. Tokens are tied to a user account, not to any individual wallet.
Sign up
POST /v1/auth/signup
Create a new Axis account. The response includes a JWT that you can use immediately — no separate login step required after registration.
When you sign up with accountType: "business", Axis automatically creates a business record and returns the businessId in the user object. For accountType: "developer", businessId will be null.
Request body
Example
For a "business" signup, businessId will be populated rather than null:
Log in
POST /v1/auth/login
Exchange credentials for a fresh JWT. Use this on returning visits after the stored token has expired or been cleared.
Request body
Log out
POST /v1/auth/logout
Invalidates the current session server-side. No request body is needed — just include your Authorization header as usual.
Using the token
Once you have a token, attach it to every protected request in the Authorization header using the Bearer scheme. Tokens expire after 7 days — after expiry, the API will return 401 Unauthorized and you will need to call POST /v1/auth/login again.
The JWT is never persisted on Axis servers after it is issued — you are responsible for storing it client-side. Common options are localStorage (simple, but exposed to XSS) or an HttpOnly secure cookie (more XSS-resistant). Whichever approach you choose, the token must be present on every request to a protected endpoint. If it is missing or expired, the API returns 401 Unauthorized.
Session tokens authenticate users. If you need to authenticate an autonomous agent making payment calls at runtime, use a wallet-scoped API key instead. See API Key Auth.