Authentication

The API uses a Bearer token (JWT). You get it with your API email and password, then send it in the Authorization header of every request.

Get a token

POST /login

This endpoint does not require a token.

Field	Type	Required	Rules
email	string	yes	Contains an @, 5 to 255 characters
password	string	yes	6 to 255 characters

curl -X POST https://services.moya-pay.com/service/api/v1/login \
  -H "Content-Type: application/json" \
  -d '{"email": "api@your-company.com", "password": "your-password"}'

Response (200)

{
  "status": "Success",
  "success": true,
  "code": 200,
  "message": "Login success",
  "user": { "email": "api@your-company.com", "phone": "0505000000" },
  "marchand": { "referencl": "CL-123456", "statut": 1 },
  "authorisation": { "token": "eyJhbGciOiJIUzI1NiIs...", "type": "bearer" }
}

Field	Description
authorisation.token	The token to use
authorisation.type	Always bearer
marchand.referencl	Your merchant reference (the value to send as refercence_cl)

Use the token

Authorization: Bearer eyJhbGciOiJIUzI1NiIs...

• The token is valid for 5 hours (18,000 seconds). There is no refresh token: log in again when it expires.
• The token is tied to your account. You can only initiate transactions for your own refercence_cl.

tip

Cache the token on your server and renew it on the first 401 response, instead of calling /login before every transaction.

Authentication errors

HTTP	Case
400	Invalid body (missing field, malformed email, password too short)
401	Wrong credentials, or merchant account disabled (details in description)
401	On other routes: missing, expired or invalid token

The response formats are described in Errors.