Xtrempay Api Documentation

Login Using Biometrics

Testing

Cloud Mock

https://mock.apidog.com/m1/918700-0-default

POST

/v1/auth/biometric/login

Maintainer:Xtrempay Devs

Use Case:
Verify that the signedPayload matches the challenge issued for the user’s device using the previously registered public key.
Purpose:
After the frontend receives the challenge, the device signs it using the private key stored in the device's secure enclave.

This endpoint verifies:

The challenge was signed correctly

The request came from the registered device

The user owns the biometric key

Request

Body Params application/json

Example

{
    "email": "omiwoletemitope@gmail.com",
    "deviceId": "b8a1f8c8-2f1a-4a33-9b6e-1234567890ab",
    "challengeId": "f24e83d4-669e-4f69-931a-d23d8d69bc1a",
    "signedPayload": "MEUCIQD5G7e...Iy4="
}

Request Code Samples

Shell

JavaScript

Java

Swift

PHP

Python

HTTP

Objective-C

Ruby

OCaml

Dart

curl --location --request POST 'https://mock.apidog.com/m1/918700-0-default/v1/auth/biometric/login' \
--header 'Content-Type: application/json' \
--data-raw '{
    "email": "omiwoletemitope@gmail.com",
    "deviceId": "b8a1f8c8-2f1a-4a33-9b6e-1234567890ab",
    "challengeId": "f24e83d4-669e-4f69-931a-d23d8d69bc1a",
    "signedPayload": "MEUCIQD5G7e...Iy4="
}'

Responses

🟢200Success

application/json

Body

Example

{
    "timestamp": "1751545072403",
    "status": 200,
    "success": true,
    "message": "Biometric login successful",
    "data": {
        "accessToken": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9…",
        "refreshToken": "e7f6d5c4-b3a2-1098-7654-3210fedcba98"
    }
}

🟠400Invalid input

Modified at 2026-01-25 21:08:04

Request Login Challenge