> ## Documentation Index
> Fetch the complete documentation index at: https://docs.pesapay.xyz/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

> SEP-10 challenge and token endpoints.

## Get a challenge

`GET /auth`

<ParamField query="account" type="string" required>
  The Stellar `G...` account to authenticate.
</ParamField>

<ResponseField name="transaction" type="string">
  A base64 XDR challenge transaction for the account to sign.
</ResponseField>

<ResponseField name="network_passphrase" type="string">
  The network the challenge is for.
</ResponseField>

```bash theme={null}
curl "https://api-testnet.pesapay.xyz/auth?account=GABC...XYZ"
```

## Exchange the signed challenge

`POST /auth`

<ParamField body="transaction" type="string" required>
  The challenge, signed by the account, as base64 XDR.
</ParamField>

<ResponseField name="token" type="string">
  A JWT whose subject is the account. Send it as `Authorization: Bearer <token>`.
</ResponseField>

```bash theme={null}
curl -X POST https://api-testnet.pesapay.xyz/auth \
  -H "content-type: application/json" \
  -d '{"transaction": "AAAAAgAAAAB..."}'
```

## Stellar discovery

`GET /.well-known/stellar.toml` publishes the web authentication endpoint and the server's signing key, as SEP-1 describes.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.