Authentication endpoints

These routes handle platform tokens, browser sessions, and onboarding initialization. Cards partner requests use partner authentication.

POST /auth/token-exchange

Exchange a token for a short-lived platform token. Send the token in the JSON body or as the authenticated request token.

curl https://api.agiodigital.com/auth/token-exchange \
  -H "Content-Type: application/json" \
  --data '{"token":"YOUR_USER_ACCESS_TOKEN"}'

Successful response:

{
  "success": true,
  "token": "SHORT_LIVED_TOKEN"
}

Missing or invalid tokens return 400. This route returns a token; it does not return a user profile or a session expiry.

GET /auth/session

Read the current browser session:

{
  "success": true,
  "timestamp": "2026-10-04T00:00:00Z",
  "sessionID": "SESSION_ID",
  "userID": "USER_ID",
  "active": true,
  "allowedFunds": [],
  "allowedOrganizations": []
}

Use the active and user fields to determine whether the session is authenticated. An unauthenticated request can also return session information.

DELETE /auth/session

Destroy the current browser session. The response includes success and a message. Destruction failures return 500.

GET /auth/logout

Destroy the user's sessions and redirect to Auth0 logout. The returnTo query parameter selects the return URL. The x-client-type request header selects the API or browser client.

With Accept: application/json, the route returns a JSON result containing redirectUrl instead of issuing a redirect.

POST /auth/alchemy-jwt

Issue a scoped JWT for smart wallet operations. The request requires an authenticated platform user or the configured administrator authentication.

Optional body fields include targetPublicKey, scope (user or organization), and organizationId. The server resolves the subject within the caller's allowed scope.

POST /auth/kyc-sdk/init-token

Generate an onboarding initialization token from your server. Send onboarding credentials in the JSON body:

curl https://api.agiodigital.com/auth/kyc-sdk/init-token \
  -H "Content-Type: application/json" \
  --data '{
    "apiToken": "YOUR_ONBOARDING_API_TOKEN",
    "externalUserId": "user-123",
    "externalUserEmail": "[email protected]",
    "ttl": 600
  }'

The response is { "token": "INIT_TOKEN" }. Optional fields also include externalUserFirstName, externalUserLastName, currency, and amount.

Keep the onboarding API credential on your server. The route returns 400 for validation failures, 403 for denied credentials, and 500 for an unknown failure.

OIDC discovery

The following public routes describe the issuer and its verification keys:

• GET /.well-known/openid-configuration
• GET /.well-known/jwks.json