Customer sign-in

Connect API · https://api.conciar.com/connect/v1

Customers sign in with a one-time 6-digit code (valid 10 minutes, 5 attempts). Verifying the code returns an access token; send it as Authorization: Bearer … on the customer routes. Codes are delivered by email: type=phone is accepted, but no SMS is sent yet.

Register a customer

Emails a sign-in code. The answer is the same when the address already belongs to a member (they simply get a code).

POST/connect/v1/auth/register

Publishable or secret key

Rate limit: 5/min per IP

Body

• first_namestringrequired

  Max 100.

• last_namestring

  Max 100.

• emailstringrequired

  Max 255.

• marketing_opt_inboolean

  Consent to marketing.

Status codes

• 422Validation failed: {status: false, message, errors}.
• 429OTP_COOLDOWN — one code per minute and five per hour per address. Body has retry_after (seconds); Retry-After header too.

curl -X POST "https://api.conciar.com/connect/v1/auth/register" \
  -H "Accept: application/json" \
  -H "X-Api-Key: pk_your_publishable_key" \
  -H "Content-Type: application/json" \
  -d '{
    "first_name": "Alex",
    "email": "alex@example.com"
  }'

Example response · 201

{
  "status": true,
  "message": "We emailed you a sign-in code.",
  "expires_in": "10 minutes"
}

Request a sign-in code

Sends a code to an existing customer. The answer is the same whether or not the address belongs to an account.

POST/connect/v1/auth/otp/request

Publishable or secret key

Rate limit: 5/min per IP

Body

• identifierstringrequired

  The email address.

• typestringrequired

  email. (phone is accepted, but no code is delivered to a phone.)

Status codes

• 422Validation failed: {message, errors}.
• 429OTP_COOLDOWN, with retry_after.

curl -X POST "https://api.conciar.com/connect/v1/auth/otp/request" \
  -H "Accept: application/json" \
  -H "X-Api-Key: pk_your_publishable_key" \
  -H "Content-Type: application/json" \
  -d '{
    "identifier": "alex@example.com",
    "type": "email"
  }'

Example response · 200

{
  "status": true,
  "message": "If this belongs to an account, we sent it a sign-in code.",
  "expires_in": "10 minutes"
}

Verify a code and get an access token

Returns the customer and a personal access token (valid 6 months; there is no refresh token — sign in again when it expires).

POST/connect/v1/auth/otp/verify

Publishable or secret key

Rate limit: 20/min per IP

Body

• identifierstringrequired

  The email address the code was sent to.

• typestringrequired

  email. (phone is accepted, but codes are only ever emailed.)

• codestringrequired

  The 6-digit code.

Status codes

• 401{status: false, message, attempts_remaining} — wrong, expired or used-up code.
• 422Validation failed: {message, errors}.

Good to know

• Verifying an emailed code also links earlier guest orders placed here with that email to the account; linked_orders counts them and the stamps and points they brought.

curl -X POST "https://api.conciar.com/connect/v1/auth/otp/verify" \
  -H "Accept: application/json" \
  -H "X-Api-Key: pk_your_publishable_key" \
  -H "Content-Type: application/json" \
  -d '{
    "identifier": "alex@example.com",
    "type": "email",
    "code": "123456"
  }'

Example response · 200

{
  "status": true,
  "data": {
    "customer": {
      "id": 4242,
      "first_name": "Alex",
      "last_name": null,
      "email": "alex@example.com",
      "organization_customer_id": 77,
      "shipping_addresses": [],
      "phones": []
    },
    "access_token": "your_customer_access_token",
    "token_type": "Bearer",
    "linked_orders": {
      "count": 0,
      "stamps": 0,
      "points": 0,
      "queued": 0
    }
  }
}

Resend a sign-in code

Same parameters and answers as requesting a code; the previous code stops working.

POST/connect/v1/auth/otp/resend

Publishable or secret key

Rate limit: 5/min per IP

Body

• identifierstringrequired

  The email address.

• typestringrequired

  email. (phone is accepted, but no code is delivered to a phone.)

Status codes

• 422Validation failed: {message, errors}.
• 429OTP_COOLDOWN, with retry_after.

curl -X POST "https://api.conciar.com/connect/v1/auth/otp/resend" \
  -H "Accept: application/json" \
  -H "X-Api-Key: pk_your_publishable_key" \
  -H "Content-Type: application/json" \
  -d '{
    "identifier": "alex@example.com",
    "type": "email"
  }'

Example response · 200

{
  "status": true,
  "message": "If this belongs to an account, we sent it a new sign-in code.",
  "expires_in": "10 minutes"
}