Authentication

Dashboard (people) — Authorization: Bearer <session token> from the sign-in flow. Routes are under /organizations/:orgId/… and checked against the member’s role. Server-to-server (your backend) — Authorization: Bearer gtt_…_sk_… or X-API-Key: gtt_…_sk_…. The key acts for one organisation and only within its scopes. Never put a key in browser or mobile code; browsers cannot send X-API-Key to this API.

Method	Path	Body	Notes
POST	`/auth/register`	`email, password, firstName?, lastName?`	202. Emails a 6-digit code. Same reply whether or not the email exists.
POST	`/auth/verify-email`	`email, code`
POST	`/auth/resend-verification`	`email`
POST	`/auth/login`	`email, password`	Returns `requiresOtp: true` and emails a code.
POST	`/auth/verify-login`	`email, code`	Returns `{ token, expiresIn, user, organizations }`.
POST	`/auth/forgot-password`	`email`	Emails a reset link (30 min).
POST	`/auth/reset-password`	`email, token, password`	Signs out every session.
GET	`/auth/me`
POST	`/auth/sign-out-everywhere`

Passwords: 10+ characters with at least one lowercase letter, one uppercase letter, one number and one special character. Codes expire after 10 minutes and die after 5 wrong attempts. Sandbox: emails ending @puzo.com always get code 123456.

API key scopes

A key can carry any of: wallets:read, wallets:fund, billing:read, hotels:read, hotels:book, giftcards:read, giftcards:purchase. Each route lists the scope it needs. Keys are created, rotated and revoked under Organisations.

Get started

Account

Products

API key scopes

​Sign-in (/auth)

​API key scopes

Sign-in (`/auth`)

API key scopes