Google Auth: Sign-up and Sign-in Flow

Signing in with a Google account is an additional option for registration and subsequent authentication in the application.

🚧

If you already have an account created via standard registration process, contact your account manager to provide the link for redirecting. The end users should enable the Google sign-in option in their profiles and complete the Google authorization flow. This will let them sign in using this method.


Register via Google Auth Flow

Step 1. Signup New User

Endpoint:

GET /reg/v1/signup/google

Use this endpoint to get a link for Google authorization form.

Headers:

NameTypeRequiredDescription
partnerIdint32Partner ID provided by the Key Account Manager.
clientIdstringPlatform type where the application is installed (IOS/WEB/ANDROID).

Request Example:

{        
    "partnerId": "6",
    "clientId": "IOS"  
}

Response Example:

{
    "url": "https://accounts.google.com/o/oauth2/auth?access_type=online&client_id=594418530070-ejih71himddjvtmqtiugu40kcguf19as.apps.googleusercontent.com&redirect_uri=https://dev-app.vault.ist/&response_type=code&scope=openid%20email&state=0a0309db-fd37-4cca-93df-edf0d72fc90a&prompt=consent"
}

Follow the provided link to proceed with authorization in Google services.


Optional Step. Verify Referral Code

Endpoint:

POST /reg/referral/code/validate

This endpoint validates referral code entered by the user.

Headers:

NameTypeRequiredDescription
partnerIdint32Partner ID provided by the Key Account Manager.

Body Parameters:

NameTypeRequiredDescription
referralCodestringReferral code applied during signup.

Request Example:

{
  "code": "string"
}

Response Example:

{
  "result": "string"
}

Step 2. Confirm User's Registration

Endpoint:

POST /reg/v1/signup/google/confirm

This endpoint confirms the signup process via Google by accepting terms and conditions, and completing user registration.

Headers:

NameTypeRequiredDescription
partnerIdint32Partner ID provided by the Key Account Manager.

Body Parameters:

NameTypeRequiredDescription
clientIdstringPlatform type where the application is installed (IOS/WEB/ANDROID).
codestringCode received after a user completes the Google authorization flow via the link provided in the initial request. Replace %2F symbols contained in the code with /.
referralCodestringReferral code applied during signup.
statestringInformation received by the backend services after a user completes the Google authorization flow.
termsAndConditionsConfirmedbooleanIndicates whether the terms and conditions are accepted.
termsAndConditionsVersionint32Version of the terms and conditions accepted.

The latest version of Terms and Conditions can be retrieved by using GET /terms-and-conditions endpoint. Read Terms and Conditions before taking further steps in creating account.

Request Example:

{   
    "clientId": "IOS",
    "code": "4/0ASc3gC3vqikGidBgsSt4ErQ1iinS8RLKSAV2-bMKVShLKPMIVGzTDDsI23ZndlECy5f3ew",
    "referralCode": null,
    "state": "0a0309db-fd37-4cca-93df-edf0d72fc90a",
    "termsAndConditionsConfirmed": true,
    "termsAndConditionsVersion": 3
  }

Response Example:

{
    "access_token": "eyJraWQiOiI5YzU1OWEyMS03ZGM3LTRjNzgtYTBkMi03OWMxNGU1MjY5YjkiLCJ0eXAiOiJKV1QiLCJhbGciOiJSUzI1NiJ9.eyJodHRwczovL2V4Y2hhbmdlLnBpL2F1dGhvcml6YXRpb24vcm9sZXMiOlsiZXhwaTpwdG46OjY6cm9sZS9jbGllbnQiXSwic3ViIjoiMWE5NWU1OWUtM2RiNy00YWZmLWIzOTYtYzRjNDViYmVkYTVmIiwiYXVkIjoicmVnaXN0cmF0aW9uIiwic2NvcGUiOiJiYW5rX2FjY291bnQ6c2hvdyBiYW5rX2FjY291bnRfdXNkOnNob3cgY2FyZGhvbGRlcl91c2VyOnJlYWQgY2FyZGhvbGRlcl91c2VyOnNob3cgY3J5cHRvX3RvX3NlcGE6c2hvdyBkZXBvc2l0X2NyeXB0bzpzaG93IGV4Y2hhbmdlOnNob3cgcGF5aW46c2hvdyBzZXBhX3RvX2NyeXB0bzpzaG93IHRyYW5zZmVyX290aGVyOmNyZWF0ZSB0cmFuc2Zlcl9vd246Y3JlYXRlIHVzZXJfbWZhOmNyZWF0ZSB1c2VyX21mYTpyZWFkIHdpdGhkcmF3X2NyeXB0bzpzaG93IiwiaXNzIjoiaHR0cHM6Ly9wbGF0Zm9ybS1hcGkuZGV2LnRlc3Rlc3NlbnRpYWwubmV0L3JlZyIsImV4cCI6MTc2ODQ2NDk2OCwidG9rZW5fdHlwZSI6ImFjY2VzcyIsImlhdCI6MTc2ODM3ODU2OCwiZ3R5IjoiY2xpZW50LWNyZWRlbnRpYWxzIiwianRpIjoiYjRkMDc2ZDUtYjNhNC00NzRjLThlMGQtNzBmMGRlNTczZWFkIn0.XSVA0B6wkXuZAwukc_T1rg8F8xDEmjX3ZfZ1wHT03HlIEMrWFQe0Qob9vz-tnGw8k8XTMCvR01cTj7gSZ7rZhFcWTecIoMjZk4TQTpB8AsNqYP13URbrwjAOtOtm-BS7Oo-QsYG6bSCsOmGurLkVyCqPjBl_PmplLOyDXW32zLEFrd-lSeeluDXzaAj3oucNMeEw6TjdI7kVuUKUQWiOXjcftJO2FPjzmOYlLovQd-PGBoTJdAFst1w416REN2uomY30lDYKjkF0ZKIdSG7UyxlmRXcXVxVeZSfpLEpedPH_0BgJhRkTvu-SSTb9wj3i-KHWx4fVyDIfAQou8ozHtA",
    "token_type": "Bearer",
    "refresh_token": "eyJraWQiOiI5YzU1OWEyMS03ZGM3LTRjNzgtYTBkMi03OWMxNGU1MjY5YjkiLCJ0eXAiOiJKV1QiLCJhbGciOiJSUzI1NiJ9.eyJzdWIiOiIxYTk1ZTU5ZS0zZGI3LTRhZmYtYjM5Ni1jNGM0NWJiZWRhNWYiLCJhdWQiOiJyZWdpc3RyYXRpb24iLCJzY29wZSI6ImJhbmtfYWNjb3VudDpzaG93IGJhbmtfYWNjb3VudF91c2Q6c2hvdyBjYXJkaG9sZGVyX3VzZXI6cmVhZCBjYXJkaG9sZGVyX3VzZXI6c2hvdyBjcnlwdG9fdG9fc2VwYTpzaG93IGRlcG9zaXRfY3J5cHRvOnNob3cgZXhjaGFuZ2U6c2hvdyBwYXlpbjpzaG93IHNlcGFfdG9fY3J5cHRvOnNob3cgdHJhbnNmZXJfb3RoZXI6Y3JlYXRlIHRyYW5zZmVyX293bjpjcmVhdGUgdXNlcl9tZmE6Y3JlYXRlIHVzZXJfbWZhOnJlYWQgd2l0aGRyYXdfY3J5cHRvOnNob3ciLCJpc3MiOiJodHRwczovL3BsYXRmb3JtLWFwaS5kZXYudGVzdGVzc2VudGlhbC5uZXQvcmVnIiwiZXhwIjoxNzcwOTcwNTY4LCJ0b2tlbl90eXBlIjoicmVmcmVzaCIsImlhdCI6MTc2ODM3ODU2OCwiZ3R5IjoiY2xpZW50LWNyZWRlbnRpYWxzIiwianRpIjoiYjRkMDc2ZDUtYjNhNC00NzRjLThlMGQtNzBmMGRlNTczZWFkIn0.NCCkHyy86-pmxJsWbeKEsrePI_qi0wLyubU_EZ0s57C-C8_R2BSdfASncPEjiwK8o2xeAiSGeLX9apgcFScdI8YrF3irt3N4zf11DYeLFwe4pMvX1xypRg3NSpgPNYJ3fDRSP5fs4Hzpbm68RXcpl8nTwjJ3CGau5e7jVl1qxfx1JiO84_ZqhKVJyWbNSBf7-tvfZ_UtWfrTaHv3crw49o69yZmTuPQuRljIPJACPU2pvvPW9ceDxQ_itk0VHv2wq3rN2eEP69YzhFJ8pltv4ZAszkSy-WuJ-ABWqX3klHhw8wWF_2XR0uugUG-lWdd_-YZHV7E2xapAjMrmbt83sg",
    "scope": "bank_account:show bank_account_usd:show cardholder_user:read cardholder_user:show crypto_to_sepa:show deposit_crypto:show exchange:show payin:show sepa_to_crypto:show transfer_other:create transfer_own:create user_mfa:create user_mfa:read withdraw_crypto:show",
    "expires_in": 604800,
    "user_id": "usr:1a95e59e-3db7-4aff-b396-c4c45bbeda5f"
}

This response provides an access_token that should be used for authenticated requests.



Sign in with Google

Step 1. Get Google Auth Url

Endpoint:

GET /reg/v1/auth/google/url

This endpoint starts user's authorization at Google by getting Google OAuth authorization URL.

Headers:

NameTypeRequiredDescription
partnerIdint32Partner ID provided by the Key Account Manager.
clientIdstringPlatform type where the application is installed (IOS/WEB/ANDROID).

Request Example:

{        
    "partnerId": "6",
    "clientId": "IOS"  
}

Response Example:

{
    "url": "https://accounts.google.com/o/oauth2/auth?access_type=online&client_id=594418530070-ejih71himddjvtmqtiugu40kcguf19as.apps.googleusercontent.com&redirect_uri=https://dev-app.vault.ist/&response_type=code&scope=openid%20email&state=5ca47a39-a265-4ab4-90ca-9eb5cc26af52&prompt=consent"
}


Step 2. Send Google Auth Details

Endpoint:

POST /reg/v1/auth/google/token

To complete authorization process, proceed with Google verification.

Headers:

NameTypeRequiredDescription
partnerIdint32Partner ID provided by the Key Account Manager.
clientIdstringPlatform type where the application is installed (IOS/WEB/ANDROID).

Body Parameters:

NameTypeRequiredDescription
codestringCode received after a user completes the Google authorization flow via the link provided in the initial request. Replace %2F symbols contained in the code with /.
statestringInformation received by the backend services after a user completes the Google authorization flow.

Request Example:

{
  "code": "4/0ASc3gC3sMbhre7bsLuDSQ108D177yVzTCb0XXy_l847Yhk9QCm0P65kC2p1HcZSKHu8sZA",
  "state": "5ca47a39-a265-4ab4-90ca-9eb5cc26af52"
}

Response Example:

{
    "access_token": "eyJraWQiOiI5YzU1OWEyMS03ZGM3LTRjNzgtYTBkMi03OWMxNGU1MjY5YjkiLCJ0eXAiOiJKV1QiLCJhbGciOiJSUzI1NiJ9.eyJodHRwczovL2V4Y2hhbmdlLnBpL2F1dGhvcml6YXRpb24vcm9sZXMiOlsiZXhwaTpwdG46OjY6cm9sZS9jbGllbnQiXSwic3ViIjoiMWE5NWU1OWUtM2RiNy00YWZmLWIzOTYtYzRjNDViYmVkYTVmIiwiYXVkIjoicmVnaXN0cmF0aW9uIiwic2NvcGUiOiJwYXlpbjpzaG93IGJhbmtfYWNjb3VudF91c2Q6c2hvdyB1c2VyX21mYTpjcmVhdGUgdHJhbnNmZXJfb3RoZXI6Y3JlYXRlIHRyYW5zZmVyX293bjpjcmVhdGUgY2FyZGhvbGRlcl91c2VyOnJlYWQgZXhjaGFuZ2U6c2hvdyB1c2VyX21mYTpyZWFkIGRlcG9zaXRfY3J5cHRvOnNob3cgY3J5cHRvX3RvX3NlcGE6c2hvdyBjYXJkaG9sZGVyX3VzZXI6c2hvdyB3aXRoZHJhd19jcnlwdG86c2hvdyBiYW5rX2FjY291bnQ6c2hvdyBzZXBhX3RvX2NyeXB0bzpzaG93IiwiaXNzIjoiaHR0cHM6Ly9wbGF0Zm9ybS1hcGkuZGV2LnRlc3Rlc3NlbnRpYWwubmV0L3JlZyIsImV4cCI6MTc2ODQ2NTM0NCwidG9rZW5fdHlwZSI6ImFjY2VzcyIsImlhdCI6MTc2ODM3ODk0NCwiZ3R5IjoiY2xpZW50LWNyZWRlbnRpYWxzIiwianRpIjoiNmI3ZjVmOTUtOWEyMy00ZGIyLThhOWItNDY0YzliNGMwN2U3In0.aaC2GTn_KxdBVolRtcsFUFuWux1AbU8CeXBnEi1E41UFK9To4B0mcD9PIqCYTv2Nl-5zsRRK2bazlDPLX7-mLbUSQMp16dHkScEuZHJZ6GAGNwJYWOL85e0x4MsHSWcvbrmu7elZsxcm8J2XPCV23qf8uUkBmLr9yrnObNcDx-P5aiCwGfvySm2sTF5eMGiw58fOaRUTl8cC36x_ebGLOLdZ-hbI9MyVauvQUu44DDqKBisAwn78SKp7mDRay4ti6m8AuQon4-G1Jo0P5IzofOA8qUOTe1pnsRsHOnie2eg2Ttcj_lJjpbUiwnxufc2750oSAPxW8OmHYOKLzorPRw",
    "token_type": "Bearer",
    "refresh_token": "eyJraWQiOiI5YzU1OWEyMS03ZGM3LTRjNzgtYTBkMi03OWMxNGU1MjY5YjkiLCJ0eXAiOiJKV1QiLCJhbGciOiJSUzI1NiJ9.eyJzdWIiOiIxYTk1ZTU5ZS0zZGI3LTRhZmYtYjM5Ni1jNGM0NWJiZWRhNWYiLCJhdWQiOiJyZWdpc3RyYXRpb24iLCJzY29wZSI6InBheWluOnNob3cgYmFua19hY2NvdW50X3VzZDpzaG93IHVzZXJfbWZhOmNyZWF0ZSB0cmFuc2Zlcl9vdGhlcjpjcmVhdGUgdHJhbnNmZXJfb3duOmNyZWF0ZSBjYXJkaG9sZGVyX3VzZXI6cmVhZCBleGNoYW5nZTpzaG93IHVzZXJfbWZhOnJlYWQgZGVwb3NpdF9jcnlwdG86c2hvdyBjcnlwdG9fdG9fc2VwYTpzaG93IGNhcmRob2xkZXJfdXNlcjpzaG93IHdpdGhkcmF3X2NyeXB0bzpzaG93IGJhbmtfYWNjb3VudDpzaG93IHNlcGFfdG9fY3J5cHRvOnNob3ciLCJpc3MiOiJodHRwczovL3BsYXRmb3JtLWFwaS5kZXYudGVzdGVzc2VudGlhbC5uZXQvcmVnIiwiZXhwIjoxNzcwOTcwOTQ0LCJ0b2tlbl90eXBlIjoicmVmcmVzaCIsImlhdCI6MTc2ODM3ODk0NCwiZ3R5IjoiY2xpZW50LWNyZWRlbnRpYWxzIiwianRpIjoiNmI3ZjVmOTUtOWEyMy00ZGIyLThhOWItNDY0YzliNGMwN2U3In0.nT1JmFLyhZ1ScVR_gBDDEfwzR4PXDywaO3lSoWiOyLoxeAvwnBLfa1mFBKPbyToQoE6bxUm-nKSd6vx9P75jQfGvPBZ7QDmNkY71QhKQJxSzH_NF8tku7oPdaneNFNDUiO4tCwix-PfbYtH42H1LHFysgc8voyo-rsQb-OP2i8bFXjKl2V0-xViqcJrFrm0rr06a4Dvfsz86rHYEbE9vuq4d3JGuubbhkMi50HYwPIi9cmn3sTQcj2Igl3TJTO1r00zsuvbzj3kGTURKxxyVms_UZvEwjJc5W6z_BCMoQS_i0KLSBvGWwKwfypJ_HcdwDJ0VWupUeycmqBR3g5L9eQ",
    "scope": "payin:show bank_account_usd:show user_mfa:create transfer_other:create transfer_own:create cardholder_user:read exchange:show user_mfa:read deposit_crypto:show crypto_to_sepa:show cardholder_user:show withdraw_crypto:show bank_account:show sepa_to_crypto:show",
    "expires_in": 604800,
    "user_id": "usr:1a95e59e-3db7-4aff-b396-c4c45bbeda5f"
}

The 424 ERROR response and the authentication token will be returned, the confirmation code will be sent to the user's email. Then use the endpoint below for 2FA authorization code verification.



Optional Step. Confirm Google 2FA

Endpoint:

POST /reg/v1/auth/google/mfa/confirm

This endpoint confirms the Google sign-in process by verifying the email confirmation code.

Headers:

NameTypeRequiredDescription
partnerIdint32Partner ID provided by the Key Account Manager.

Body Parameters:

NameTypeRequiredDescription
mfaCodestringConfirmation code sent to the user's email.
mfaTokenstringA multi-factor authentication token used to handle 2FA workflow.

Request Example:

{
  "mfaCode": "123456",
  "mfaToken": "f1303577-9fd9-4220-8cca-a813cd4d7b40"
}

Response Example:

{
    "access_token": "eyJraWQiOiI5YzU1OWEyMS03ZGM3LTRjNzgtYTBkMi03OWMxNGU1MjY5YjkiLCJ0eXAiOiJKV1QiLCJhbGciOiJSUzI1NiJ9.eyJodHRwczovL2V4Y2hhbmdlLnBpL2F1dGhvcml6YXRpb24vcm9sZXMiOlsiZXhwaTpwdG46OjY6cm9sZS9jbGllbnQiXSwic3ViIjoiMWE5NWU1OWUtM2RiNy00YWZmLWIzOTYtYzRjNDViYmVkYTVmIiwiYXVkIjoicmVnaXN0cmF0aW9uIiwic2NvcGUiOiJwYXlpbjpzaG93IGJhbmtfYWNjb3VudF91c2Q6c2hvdyB1c2VyX21mYTpjcmVhdGUgdHJhbnNmZXJfb3RoZXI6Y3JlYXRlIHRyYW5zZmVyX293bjpjcmVhdGUgY2FyZGhvbGRlcl91c2VyOnJlYWQgZXhjaGFuZ2U6c2hvdyB1c2VyX21mYTpyZWFkIGRlcG9zaXRfY3J5cHRvOnNob3cgY3J5cHRvX3RvX3NlcGE6c2hvdyBjYXJkaG9sZGVyX3VzZXI6c2hvdyB3aXRoZHJhd19jcnlwdG86c2hvdyBiYW5rX2FjY291bnQ6c2hvdyBzZXBhX3RvX2NyeXB0bzpzaG93IiwiaXNzIjoiaHR0cHM6Ly9wbGF0Zm9ybS1hcGkuZGV2LnRlc3Rlc3NlbnRpYWwubmV0L3JlZyIsImV4cCI6MTc2ODQ2NjEzMywidG9rZW5fdHlwZSI6ImFjY2VzcyIsImlhdCI6MTc2ODM3OTczMywiZ3R5IjoiY2xpZW50LWNyZWRlbnRpYWxzIiwianRpIjoiNDcwNTZiMzMtZjliOS00NzEzLWFkMmMtNGIxOGRiY2Q2NmMwIn0.CA2QRNqSu77Gl0AONOSPaFJgpyfACiSUxGUI7IYhi6GVxitrwsMlzRS1m-_9xMt1sP4o44GMkRmvksoph-tj35DggswckmbunHQh-LV-z3sYnnlfTjOeeViVICcROxMEtWl5j9jTgCAO0rgJn8Ko1Hgg4Ea0EY5H6iKkHh_B41o8044Ik_IVf5tN1997ErEo1xiqcmOaw8si15Vcq2JDVVd_NOeXe3oMcIhgWQ0psjX1apoo6UOXRwSSRgbpVg-l2s0tCCOyQh-3kaOfjGeOT3-24ypP2BT_BEO1NxylOtiGHJz5F3QNYdXtXJHacHWrXADoG3d4NJu6ixMEGBc35A",
    "token_type": "Bearer",
    "refresh_token": "eyJraWQiOiI5YzU1OWEyMS03ZGM3LTRjNzgtYTBkMi03OWMxNGU1MjY5YjkiLCJ0eXAiOiJKV1QiLCJhbGciOiJSUzI1NiJ9.eyJzdWIiOiIxYTk1ZTU5ZS0zZGI3LTRhZmYtYjM5Ni1jNGM0NWJiZWRhNWYiLCJhdWQiOiJyZWdpc3RyYXRpb24iLCJzY29wZSI6InBheWluOnNob3cgYmFua19hY2NvdW50X3VzZDpzaG93IHVzZXJfbWZhOmNyZWF0ZSB0cmFuc2Zlcl9vdGhlcjpjcmVhdGUgdHJhbnNmZXJfb3duOmNyZWF0ZSBjYXJkaG9sZGVyX3VzZXI6cmVhZCBleGNoYW5nZTpzaG93IHVzZXJfbWZhOnJlYWQgZGVwb3NpdF9jcnlwdG86c2hvdyBjcnlwdG9fdG9fc2VwYTpzaG93IGNhcmRob2xkZXJfdXNlcjpzaG93IHdpdGhkcmF3X2NyeXB0bzpzaG93IGJhbmtfYWNjb3VudDpzaG93IHNlcGFfdG9fY3J5cHRvOnNob3ciLCJpc3MiOiJodHRwczovL3BsYXRmb3JtLWFwaS5kZXYudGVzdGVzc2VudGlhbC5uZXQvcmVnIiwiZXhwIjoxNzcwOTcxNzMzLCJ0b2tlbl90eXBlIjoicmVmcmVzaCIsImlhdCI6MTc2ODM3OTczMywiZ3R5IjoiY2xpZW50LWNyZWRlbnRpYWxzIiwianRpIjoiNDcwNTZiMzMtZjliOS00NzEzLWFkMmMtNGIxOGRiY2Q2NmMwIn0.PP7BLolV6viy6bkKyGiKHgbFma5MmShLCgWDua5o4xxlOR7pShHQat0n5fnVolJ_wlYqoNJuOcOhfc_nEth3mYrKM8geu3yFchzU6J_4xT0-tWUsbFK9Xz3TtqgXi-bpIF57ANqhJpkYKA0YrVT80yHJTsE44IBawmJoycrO43n-Y94uuvnPNnCmzVwnGE-cgO3gEbenHQZ9LBoTDfgnBJM4cwVdydz-0_Kyiu0AMHcfYuHA1IB2DgCremYO7faSGIPgqrzuiEuEvlG_ZUGTc4BUdg1EYCBnBfvuolB791eC_qfC_Ke2VWiW--HmwhLWJueGHOY_lvN3h-3dsPjPWQ",
    "scope": "payin:show bank_account_usd:show user_mfa:create transfer_other:create transfer_own:create cardholder_user:read exchange:show user_mfa:read deposit_crypto:show crypto_to_sepa:show cardholder_user:show withdraw_crypto:show bank_account:show sepa_to_crypto:show",
    "expires_in": 604800,
    "user_id": "usr:1a95e59e-3db7-4aff-b396-c4c45bbeda5f"
}

Step 3. Set Password

When registering via Google, the account will not have a password. It can be set later in the user profile to access the app using the standard login and password combination.

Endpoint:

POST /reg/v2/password/set

Set valid password for users registered with google.

🚧

Password Requirements

  • Length 10 to 32 characters.
  • Only Latin letters.
  • Must contain at least 1 number.
  • Must contain at least 1 symbol (e.g., !, @, #, $).
  • Must include at least 1 uppercase and 1 lowercase letter.
  • A weak password (e.g., including qwerty or 12345 combinations) will not be accepted.

Body Parameters:

NameTypeRequiredDescription
newPasswordstringNew password to be set.

Request Example:

{
  "newPassword": "aVogaghjfsa89gds!!"
}

Response Example:

{
  "result": "ok"
}


Purchase a Subscription

Once registration and verification steps are completed, the user should be offered to opt a subscription.
Subscriptions provide recurring access to services based on different tiers.

To integrate and manage subscriptions, refer to the full Subscription Guide.