Authentication

Overview

Cryptorobot.ai supports multiple authentication strategies:

Strategy	Use Case	Method
Local (Email + Password)	User login from apps	`POST /authentication`
Google OAuth	Social login	OAuth2 redirect flow
JWT Bearer Token	Authenticated API calls	`Authorization: Bearer <token>`
API Key	Server-to-server / bots	`Authorization: ApiKey <key>`

Exchange email and password for a JWT access token:

curl -X POST https://api.cryptorobot.ai/authentication \
  -H "Content-Type: application/json" \
  -d '{
    "strategy": "local",
    "email": "user@example.com",
    "password": "your-password"
  }'

const response = await fetch('https://api.cryptorobot.ai/authentication', {
  method: 'POST',
  headers: { 'Content-Type': 'application/json' },
  body: JSON.stringify({
    strategy: 'local',
    email: 'user@example.com',
    password: 'your-password'
  })
});

const { accessToken, user } = await response.json();

import requests

response = requests.post('https://api.cryptorobot.ai/authentication', json={
    'strategy': 'local',
    'email': 'user@example.com',
    'password': 'your-password'
})

data = response.json()
token = data['accessToken']
user = data['user']

Response

{
  "accessToken": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...",
  "authentication": {
    "strategy": "local",
    "accessToken": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9..."
  },
  "user": {
    "_id": "507f1f77bcf86cd799439011",
    "email": "user@example.com",
    "name": "John Doe",
    "plan": "pro",
    "verified": true
  }
}

Using the Token

Include the JWT token in the Authorization header for all authenticated requests:

curl https://api.cryptorobot.ai/strategies \
  -H "Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9..."

Tokens expire after a configured TTL (default: 7 days). When a token expires, you’ll receive a 401 Not Authenticated error. Re-authenticate to get a fresh token.

Token Refresh

Tokens can be refreshed by authenticating with the existing (still valid) token:

curl -X POST https://api.cryptorobot.ai/authentication \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer eyJ..." \
  -d '{"strategy": "jwt", "accessToken": "eyJ..."}'

Google OAuth

For web applications, redirect users to the Google OAuth flow:

GET https://api.cryptorobot.ai/oauth/google

After successful authentication, the user is redirected to your callback URL with the JWT token.

Logout

Invalidate the current session:

curl -X DELETE https://api.cryptorobot.ai/authentication \
  -H "Authorization: Bearer eyJ..."

This revokes the session server-side. The JWT will be rejected on subsequent requests.

Session Management

List active sessions for the current user:

curl https://api.cryptorobot.ai/users/sessions \
  -H "Authorization: Bearer eyJ..."

{
  "total": 3,
  "data": [
    {
      "_id": "session-id-1",
      "userAgent": "Mozilla/5.0...",
      "ip": "192.168.1.1",
      "createdAt": "2024-01-15T10:00:00Z",
      "lastActive": "2024-01-15T14:30:00Z"
    }
  ]
}

Security Best Practices

Store tokens securely

Never expose JWT tokens in client-side JavaScript, URLs, or logs. Use httpOnly cookies or secure storage mechanisms.

Use API keys for bots

For automated trading bots and server-to-server communication, use API keys instead of user credentials.

Rotate credentials regularly

Periodically rotate API keys and re-authenticate to minimize exposure from leaked credentials.

Use HTTPS only

All API requests must use HTTPS. HTTP requests are rejected.

Email Verification

New accounts must verify their email before full access is granted:

# Resend verification email
curl -X POST https://api.cryptorobot.ai/auth-management \
  -H "Content-Type: application/json" \
  -d '{"action": "resendVerifySignup", "value": {"email": "user@example.com"}}'

Password Reset

# Request password reset
curl -X POST https://api.cryptorobot.ai/auth-management \
  -H "Content-Type: application/json" \
  -d '{"action": "sendResetPwd", "value": {"email": "user@example.com"}}'

# Complete password reset (with token from email)
curl -X POST https://api.cryptorobot.ai/auth-management \
  -H "Content-Type: application/json" \
  -d '{"action": "resetPwdLong", "value": {"token": "reset-token-from-email", "password": "new-password"}}'

Getting Started

Core Concepts

Authentication

Overview

Response

Using the Token

Token Refresh

Google OAuth

Logout

Session Management

Security Best Practices

Email Verification

Password Reset

​Overview

​Login (Local Strategy)

​Response

​Using the Token

​Token Refresh

​Google OAuth

​Logout

​Session Management

​Security Best Practices

​Email Verification

​Password Reset

Overview

Login (Local Strategy)

Response

Using the Token

Token Refresh

Google OAuth

Logout

Session Management

Security Best Practices

Email Verification

Password Reset