Log in

curl -X POST https://api.vouchmark.com/v1/login \
  -H "Content-Type: application/json" \
  -d '{"email":"ada@example.com","password":"L0ng-Random-Pass!"}'

{
  "success": true,
  "message": "Login Successful",
  "data": {
    "userId": "usr_aBcD..."
  }
}

POST

curl -X POST https://api.vouchmark.com/v1/login \
  -H "Content-Type: application/json" \
  -d '{"email":"ada@example.com","password":"L0ng-Random-Pass!"}'

{
  "success": true,
  "message": "Login Successful",
  "data": {
    "userId": "usr_aBcD..."
  }
}

Authenticates a user and starts a session by setting httpOnly auth cookies. Public endpoint, rate-limited to 50 requests per 15 minutes per IP.

Body

string

required

string

required

curl -X POST https://api.vouchmark.com/v1/login \
  -H "Content-Type: application/json" \
  -d '{"email":"ada@example.com","password":"L0ng-Random-Pass!"}'

{
  "success": true,
  "message": "Login Successful",
  "data": {
    "userId": "usr_aBcD..."
  }
}

On success the response sets two httpOnly cookies — token (the access token) and refreshToken — plus a non-httpOnly vm_session hint cookie. The tokens are not included in the JSON body. For server-to-server calls, read the value of the token cookie and send it as Authorization: Bearer <token> on subsequent requests. If the account exists but its email is not yet verified, the request returns 403 and a fresh verification code is emailed:

{
  "success": false,
  "error": "Email not verified",
  "message": "Please verify your email before logging in. A new verification code has been sent to your email.",
  "data": {
    "requiresVerification": true,
    "userId": "usr_aBcD..."
  }
}

Overview

Auth

Companies

Verifications

Onboarding (KYB)

Widget Embed (Runtime)

Trust Badge

Monitoring

Investigations

Disputes

Vouch AI

Compliance

Wallet & Billing

Developers

Body

​Body

Body