Authentication

Starter and higher plans can create a named, scoped API key in Settings and send it as a Bearer token on protected endpoints.

Use named keys for applications

Choose from currencies, convert, rates, usage, history, and batch abilities. Batch is reserved for Phase 2. The plaintext key is revealed only once; store it in a secret manager and revoke it from Settings when it is no longer needed.

POST

/api/login

This compatibility/bootstrap endpoint has no authentication requirement, but token issuance requires Starter or higher. It issues a finite token for the currently entitled abilities. Prefer the API keys settings page for ongoing use.

Request body

{
  "email": "api@example.com",
  "password": "your-password"
}

Successful response

HTTP 200

{
  "token": "1|aBcDeFgHiJkLmNoPqRsTuVwXyZ...",
  "token_type": "Bearer"
}

Using the token

Include the token on every authenticated request:

Authorization: Bearer 1|aBcDeFgHiJkLmNoPqRsTuVwXyZ...

Example

curl -X POST https://ezforex.your-developer.co.za/api/login \
  -H "Accept: application/json" \
  -H "Content-Type: application/json" \
  -d '{"email":"api@example.com","password":"your-password"}'

Errors

401 — Invalid email or password.
422 — Validation failed (missing or invalid fields).
429 — Too many login attempts; retry later.