API Reference

User Registration & Auth

Each Partner API user is a Qwik-managed identity scoped to your organization. A user registered under your org cannot sign into the Qwik consumer app, and Qwik consumers cannot use your endpoints. An email/phone already registered on the main Qwik app is rejected.

POST/partner/auth/register

🔑 Org key + secret
FieldTypeRequiredNotes
emailstring✅Valid email.
phone_numberstring✅Min 10 chars, E.164 recommended (+1555…).
first_namestring✅
last_namestring✅
passwordstring✅Min 6 chars.
ssnstring✅Normalized server-side; 123-45-6789 or 123456789.
date_of_birthstring—YYYY-MM-DD.
addressobject—{ line1, line2, city, state, zipcode, country } (all optional).
secondary_addressobject—Same shape.
metadataobject—Arbitrary key/values you want stored on the user.
201 · Response
{ "userId": "firebase-uid", "email": "john@example.com", "phone_number": "+15551234567", "first_name": "John", "last_name": "Doe" }

POST/partner/auth/login

🔑 Org key + secret

Verifies the password, then sends a one-time code to the matching email/phone. Does not return a session yet.

Body: password (required) + either email or phone_number.

200 · Response
{
  "message": "OTP sent",
  "userId": "..."
}

POST/partner/auth/verify-otp

🔑 Org key + secret

Exchanges the OTP for a session token.

Body: code (required, ≥4 chars) + either email or phone_number.

200 · Response
{
  "sessionToken": "eyJhbGciOiJSUzI1NiIsInR5cCI6...",
  "expiresAt": 1750000000000,
  "user": { "id": "...", "email": "...", "phone_number": "...", "first_name": "John", "last_name": "Doe", "kyc_status": "pending" }
}

POST/partner/auth/forgot-password/send-otp

🔑 Org key + secret

Body: email or phone_number. Always returns the same generic message (to avoid leaking which accounts exist):

200 · Response
{
  "message": "If an account exists for that contact, a password reset OTP has been sent."
}

POST/partner/auth/forgot-password/reset

🔑 Org key + secret

Body: (email or phone_number) + code (≥4) + new_password (≥6).

200 · Response
{
  "message": "Password updated successfully"
}

POST/partner/auth/change-password

🔑 Org key + secret👤 User session

Body: current_password, new_password (≥6, must differ from current).

200 · Response
{
  "message": "Password updated successfully"
}

POST/partner/auth/logout

🔑 Org key + secret👤 User session

Revokes the current session.

200 · Response
{
  "message": "Logged out successfully"
}