Build with OneTimeLogin

Get a 200 from /api/auth/login with typical guided setup

Follow these five steps in order. By the end, your app will be receiving real OneTimeLogin access tokens.

1. 1

   Register your site

   Create a business account and add your site. This unlocks the API console where your keys live.

   Register your site
2. 2

   Grab your API key

   After registration, your Site Key is shown once on the dashboard at Dashboard → Settings → API Keys. Store it in your server-side secret manager — never commit it.

3. 3

   Configure your callback URL

   Tell OneTimeLogin where to redirect users after a successful login. Set it under Settings → Callback URL. Use HTTPS in production. Localhost is allowed in dev.

4. 4

   Test login with code

   Pick your stack and run the snippet. Replace YOUR_SITE_KEY with the key from Step 2.

   cURL Node.js Python Copy

   curl -X POST https://api.onetimelogin.com/api/auth/login \
     -H "Content-Type: application/json" \
     -H "X-OTL-Site-Key: YOUR_SITE_KEY" \
     -d '{"email":"user@example.com","password":"REDACTED"}'

   const res = await fetch('https://api.onetimelogin.com/api/auth/login', {
     method: 'POST',
     headers: {
       'Content-Type': 'application/json',
       'X-OTL-Site-Key': process.env.OTL_SITE_KEY,
     },
     body: JSON.stringify({ email, password }),
   });
   const data = await res.json();
   // data.access_token + data.refresh_token

   import requests
   res = requests.post(
       'https://api.onetimelogin.com/api/auth/login',
       headers={
           'Content-Type': 'application/json',
           'X-OTL-Site-Key': OTL_SITE_KEY,
       },
       json={'email': email, 'password': password},
   )
   data = res.json()
   # data['access_token'] + data['refresh_token']

5. 5

   Verify the response

   A successful login returns HTTP 200 and a payload like this:

   {
     "access_token": "<jwt>",
     "refresh_token": "<opaque>",
     "token_type": "Bearer",
     "expires_in": 1800,
     "user": {
       "id": "01HKZ...",
       "email": "user@example.com",
       "name": "Jane Doe"
     }
   }

   Send access_token on every authenticated call as Authorization: Bearer <access_token>.

Need to revoke a token? See Sessions. Building a webhook receiver? See Events. Want SAML instead? See Enterprise SSO.