Authentication

The StampMitra B2B API authenticates every request with an API key. Keys are environment-scoped and carry scopes that gate individual endpoints.

Sandbox vs Production

Sandbox keys are prefixed sk_test_, production keys sk_live_. Get a sandbox key instantly via self-signup; production keys require a KYC-approved organization.

Sending your key

Authorization: Bearer sk_test_xxxxxxxxxxxx
# or
x-api-key: sk_test_xxxxxxxxxxxx

Sandbox Self-Signup

POST/v1/auth/signup/otp

● Live

Request a signup OTP

Public, unauthenticated. Rate-limited per-IP and per-email. Sends an OTP to complete sandbox signup.

Parameters

Name	Type	Required	Description
email	string	Yes	Signup email.
mobileNumber	string	Yes	Signup mobile number.
organizationName	string	Yes	Organization name.

Example response

{
  "status": "sent",
  "requestId": "req_abc123"
}

POST/v1/auth/signup

● Live

Verify OTP and create a sandbox org + owner user + API key

Verifies the OTP and creates the Organization, owner User, a SANDBOX tenant, and a sk_test_ API key. The raw key is returned exactly once in this response and never again.

Parameters

Name	Type	Required	Description
email	string	Yes	Signup email.
mobileNumber	string	Yes	Signup mobile number.
organizationName	string	Yes	Organization name.
code	string	Yes	OTP code.
fullName	string	Yes	Owner's full name.

Example response

{
  "organizationId": "org_123",
  "userId": "usr_123",
  "tenantId": "tnt_123",
  "environment": "SANDBOX",
  "apiKey": {
    "id": "key_123",
    "rawKey": "sk_test_...",
    "prefix": "sk_test_ab12"
  }
}

API Key Authentication

GET(applies to every /v1/* endpoint)

● Live

Bearer API key + scopes

Every protected endpoint requires either `Authorization: Bearer <key>` or an `x-api-key: <key>` header. Keys are environment-scoped (SANDBOX `sk_test_...` vs PRODUCTION `sk_live_...`) and carry a list of OAuth-style scopes (e.g. `verification.pan.read`, `orders.create`, `payments.write`). Sensitive scopes can additionally be restricted to an IP allowlist. Requests are also subject to per-endpoint rate limits enforced server-side.

Dashboard Login

POST/v1/auth/login

◐ Planned / TODO

[PLANNED] Dashboard user login

NOT YET IMPLEMENTED as a discovered public route in stampmitra-b2b-platform (only end-customer-auth and sandbox signup were found). The dashboard login screen in this app is a UI-only stub until a real dashboard-user login endpoint is confirmed.