Authentication

JWT sessions and API keys use the same Bearer header.

  1. Docs
  2. Authentication

Every protected route expects an Authorization header. Netnaunse accepts two credential types on the same scheme:

JWTShort-lived session token from POST /v1/auth/login or register. Ideal for dashboards and interactive clients.
API keyLong-lived secret beginning with nn_. Create in the app or via POST /v1/auth/api-keys. Store server-side only.
Authorization header
Authorization: Bearer <jwt_or_nn_api_key>

Register

Creates a user, organisation, and wallet. Prefer the dashboard for most teams; the API is available for automation.

POST /v1/auth/register
curl -X POST https://api.netnaunse.com/v1/auth/register \
  -H "Content-Type: application/json" \
  -d '{
    "email": "you@company.com",
    "password": "at-least-8-chars",
    "firstName": "Amina",
    "lastName": "Juma",
    "organizationName": "Karibu SACCO"
  }'

Login

POST /v1/auth/login
curl -X POST https://api.netnaunse.com/v1/auth/login \
  -H "Content-Type: application/json" \
  -d '{
    "email": "you@company.com",
    "password": "at-least-8-chars"
  }'

The response includes a Bearer token and user/organisation context. Use that token on subsequent calls.

Current user

GET /v1/auth/me
curl https://api.netnaunse.com/v1/auth/me \
  -H "Authorization: Bearer YOUR_TOKEN"

API keys

  • GET /v1/auth/api-keys — list keys for your organisation (secrets are not re-shown)
  • POST /v1/auth/api-keys — create a key; the full nn_… secret is returned once
  • POST /v1/auth/api-keys/{id}/disable — revoke a key

Manage keys in the dashboard at app.netnaunse.com/api-keys.

SecurityNever embed API keys in mobile apps, public repositories, or front-end JavaScript. Rotate compromised keys immediately.

Next: SMS API