Authentication

Get a challenge

GET /auth

string

required

The Stellar G... account to authenticate.

string

A base64 XDR challenge transaction for the account to sign.

string

The network the challenge is for.

curl "https://api-testnet.pesapay.xyz/auth?account=GABC...XYZ"

POST /auth

string

required

The challenge, signed by the account, as base64 XDR.

string

A JWT whose subject is the account. Send it as Authorization: Bearer <token>.

curl -X POST https://api-testnet.pesapay.xyz/auth \
  -H "content-type: application/json" \
  -d '{"transaction": "AAAAAgAAAAB..."}'

GET /.well-known/stellar.toml publishes the web authentication endpoint and the server’s signing key, as SEP-1 describes.