Authentication
User registration, login, OTP, password reset and token management
Creates a new user account. No authentication required. For Manager role, a company is created automatically. For Association, an association is created. 2FA is auto-enabled for Manager, SuperManager, Cashier and Observer.
Language for the verification email
Must match password complexity requirements (uppercase, lowercase, digit, special char)
User role — determines company/association creation
Required for Manager and Cashier roles
Required for Association role
ISO country code, e.g. FR
User registered successfully.
Whether the request succeeded
HTTP status code
User already exists or validation error
Validation error
POST /api/next/auth/register HTTP/1.1
Host: api.lyzi.fr
Content-Type: application/json
Accept: */*
Content-Length: 212
{
"email": "name@gmail.com",
"password": "text",
"firstName": "text",
"lastName": "text",
"role": "SimpleUser",
"companyName": "text",
"associationName": "text",
"origin": "text",
"phoneNumber": "text",
"phoneNumberCountry": "text"
}{
"success": true,
"status": 1,
"data": {
"user": {
"_id": "text",
"email": "name@gmail.com",
"firstName": "text",
"lastName": "text",
"role": "SuperAdmin",
"phoneNumber": "text",
"apiKey": "text",
"valid": true,
"twoFactorAuthEnabled": true,
"lastConnection": "2026-01-01T00:00:00.000Z",
"company": {}
},
"token": "text"
}
}Authenticates a merchant manager, super manager, cashier, observer or association user. If 2FA is enabled, an otpValidationToken cookie is set and the final access token is only returned after calling /auth/otp. The origin field must be dashboard for the backoffice or application for the mobile app.
Login origin — 'dashboard' for backoffice, 'application' for mobile app
Login successful. If 2FA is enabled, token is null and an otpValidationToken cookie is set. Call /auth/otp to complete authentication.
Whether the request succeeded
HTTP status code
Invalid credentials
Unauthorized (VPN required for SuperAdmin)
Validation error
POST /api/next/auth/login/manager HTTP/1.1
Host: api.lyzi.fr
Content-Type: application/json
Accept: */*
Content-Length: 65
{
"email": "name@gmail.com",
"password": "text",
"origin": "dashboard"
}{
"success": true,
"status": 1,
"data": {
"token": "text",
"user": {
"_id": "text",
"email": "name@gmail.com",
"firstName": "text",
"lastName": "text",
"role": "SuperAdmin",
"phoneNumber": "text",
"apiKey": "text",
"valid": true,
"twoFactorAuthEnabled": true,
"lastConnection": "2026-01-01T00:00:00.000Z",
"company": {}
}
}
}Validates a TOTP code (authenticator app) or email OTP after login when 2FA is enabled. The otpValidationToken cookie (set by /auth/login/manager) must be present. Returns the final JWT access token on success.
Roles: Manager, SuperManager, SuperAdmin, Cashier, Observer
JWT token obtained from /auth/login or /auth/login/manager. Include as Authorization: Bearer <token>.
6-digit TOTP code from authenticator app
6-digit OTP received by email
OTP validated — final JWT access token returned
Whether the request succeeded
HTTP status code
Invalid or expired OTP
Authorization header required
POST /api/next/auth/otp HTTP/1.1
Host: api.lyzi.fr
Authorization: Bearer YOUR_SECRET_TOKEN
Content-Type: application/json
Accept: */*
Content-Length: 32
{
"otp": "text",
"emailOtp": "text"
}{
"success": true,
"status": 1,
"data": {
"token": "text",
"user": {
"_id": "text",
"email": "name@gmail.com",
"firstName": "text",
"lastName": "text",
"role": "SuperAdmin",
"phoneNumber": "text",
"apiKey": "text",
"valid": true,
"twoFactorAuthEnabled": true,
"lastConnection": "2026-01-01T00:00:00.000Z",
"company": {}
}
}
}Sends a one-time passcode to the provided email address. Used during 2FA login when the user prefers email OTP over authenticator app.
OTP sent successfully
Whether the request succeeded
HTTP status code
Response payload
Validation error
POST /api/next/auth/otp/email HTTP/1.1
Host: api.lyzi.fr
Content-Type: application/json
Accept: */*
Content-Length: 26
{
"email": "name@gmail.com"
}{
"success": true,
"status": 1,
"data": null
}Sends a password reset link to the provided email address. SuperAdmin accounts are excluded.
Language for the reset email
If 'application', returns the reset token directly instead of sending an email
Reset email sent (or token returned if origin=application)
Whether the request succeeded
HTTP status code
Response payload
User not found
Validation error
POST /api/next/auth/reset-password/send HTTP/1.1
Host: api.lyzi.fr
Content-Type: application/json
Accept: */*
Content-Length: 42
{
"email": "name@gmail.com",
"origin": "text"
}{
"success": true,
"status": 1,
"data": null
}Sets a new password using the token received in the reset email. Sends a notification email after the change.
Token from the password reset email
New password (must match complexity requirements)
Password changed successfully
Whether the request succeeded
HTTP status code
Response payload
Invalid or missing token
Validation error
POST /api/next/auth/reset-password/change HTTP/1.1
Host: api.lyzi.fr
Content-Type: application/json
Accept: */*
Content-Length: 37
{
"token": "text",
"newPassword": "text"
}{
"success": true,
"status": 1,
"data": null
}Issues a new JWT access token using the refresh token stored in an httpOnly cookie. For backoffice users, pass the user ID via the x-user-id header so the correct cookie is read.
User ID (backoffice sessions only) — determines the refresh token cookie name
New access token issued
Whether the request succeeded
HTTP status code
Invalid or expired refresh token
POST /api/next/auth/refresh-token HTTP/1.1
Host: api.lyzi.fr
Accept: */*
{
"success": true,
"status": 1,
"data": {
"token": "text"
}
}Clears the refresh token cookie, effectively ending the session. Pass the x-user-id header for backoffice sessions.
User ID (backoffice sessions only)
Signed out successfully
Whether the request succeeded
HTTP status code
POST /api/next/auth/sign-out HTTP/1.1
Host: api.lyzi.fr
Accept: */*
Signed out successfully
{
"success": true,
"status": 1,
"data": {
"disconnected": true
}
}Last updated