Google Auth: Sign-up and Sign-in Flow

Signing in with a Google account is an additional option for registration and subsequent authentication in the application.

🚧

If you already have an account created via standard registration process, contact your account manager to provide the link for redirecting. The end users should enable the Google sign-in option in their profiles and complete the Google authorization flow. This will let them sign in using this method.


Register via Google Auth Flow

Step 1. Signup New User

Endpoint

GET /reg/v1/signup/google

Description

Retrieves a Google OAuth authorization URL to start the signup process for a new user via Google account.

Headers:

NameTypeRequiredDescription
partnerIdint32Partner ID provided by the Key Account Manager.
clientIdstringPlatform type where the application is installed (IOS/WEB/ANDROID).

Request Example

{        
    "partnerId": "6",
    "clientId": "IOS"  
}

Response Example

{
    "url": "https://accounts.google.com/o/oauth2/auth?access_type=online&client_id=594418530070-ejih71himddjvtmqtiugu40kcguf19as.apps.googleusercontent.com&redirect_uri=https://dev-app.vault.ist/&response_type=code&scope=openid%20email&state=0a0309db-fd37-4cca-93df-edf0d72fc90a&prompt=consent"
}

Follow the provided link to proceed with authorization in Google services.


Optional Step. Verify Referral Code

Endpoint

POST /reg/referral/code/validate

Description

Validates a referral code provided by the user during signup.

Headers:

NameTypeRequiredDescription
partnerIdint32Partner ID provided by the Key Account Manager.

Body Parameters

NameTypeRequiredDescription
referralCodestringReferral code applied during signup.

Request Example

{
  "code": "string"
}

Response Example

{
  "result": "string"
}

Step 2. Confirm User's Registration

Endpoint

POST /reg/v1/signup/google/confirm

Description

Confirms the Google signup process by completing user registration with the provided authorization code, state, and terms acceptance.

Headers

NameTypeRequiredDescription
partnerIdint32Partner ID provided by the Key Account Manager.

Body Parameters

NameTypeRequiredDescription
clientIdstringPlatform type where the application is installed (IOS/WEB/ANDROID).
codestringCode received after a user completes the Google authorization flow via the link provided in the initial request. Replace %2F symbols contained in the code with /.
referralCodestringReferral code applied during signup.
statestringInformation received by the backend services after a user completes the Google authorization flow.
termsAndConditionsConfirmedbooleanIndicates whether the terms and conditions are accepted.
termsAndConditionsVersionint32Version of the terms and conditions accepted.

The latest version of Terms and Conditions can be retrieved by using GET /terms-and-conditions endpoint. Read Terms and Conditions before taking further steps in creating account.

Request Example

{   
    "clientId": "IOS",
    "code": "4/0ASc3gC3vqikGidBgsSt4ErQ1iinS8RLKSAV2-bMKVShLKPMIVGzTDDsI23ZndlECy5f3ew",
    "referralCode": null,
    "state": "0a0309db-fd37-4cca-93df-edf0d72fc90a",
    "termsAndConditionsConfirmed": true,
    "termsAndConditionsVersion": 3
  }

Response Example

{
    "access_token": "eyJraWQiOiI5YzU1OWEyMS03ZGM3LTRjNzgtYTBkMi03OWMxNGU1MjY5YjkiLCJ0eXAiOiJKV1QiLCJhbGciOiJSUzI1NiJ9.eyJodHRwczovL2V4Y2hhbmdlLnBpL2F1dGhvcml6YXRpb24vcm9sZXMiOlsiZXhwaTpwdG46OjY6cm9sZS9jbGllbnQiXSwic3ViIjoiMWE5NWU1OWUtM2RiNy00YWZmLWIzOTYtYzRjNDViYmVkYTVmIiwiYXVkIjoicmVnaXN0cmF0aW9uIiwic2NvcGUiOiJiYW5rX2FjY291bnQ6c2hvdyBiYW5rX2FjY291bnRfdXNkOnNob3cgY2FyZGhvbGRlcl91c2VyOnJlYWQgY2FyZGhvbGRlcl91c2VyOnNob3cgY3J5cHRvX3RvX3NlcGE6c2hvdyBkZXBvc2l0X2NyeXB0bzpzaG93IGV4Y2hhbmdlOnNob3cgcGF5aW46c2hvdyBzZXBhX3RvX2NyeXB0bzpzaG93IHRyYW5zZmVyX290aGVyOmNyZWF0ZSB0cmFuc2Zlcl9vd246Y3JlYXRlIHVzZXJfbWZhOmNyZWF0ZSB1c2VyX21mYTpyZWFkIHdpdGhkcmF3X2NyeXB0bzpzaG93IiwiaXNzIjoiaHR0cHM6Ly9wbGF0Zm9ybS1hcGkuZGV2LnRlc3Rlc3NlbnRpYWwubmV0L3JlZyIsImV4cCI6MTc2ODQ2NDk2OCwidG9rZW5fdHlwZSI6ImFjY2VzcyIsImlhdCI6MTc2ODM3ODU2OCwiZ3R5IjoiY2xpZW50LWNyZWRlbnRpYWxzIiwianRpIjoiYjRkMDc2ZDUtYjNhNC00NzRjLThlMGQtNzBmMGRlNTczZWFkIn0.XSVA0B6wkXuZAwukc_T1rg8F8xDEmjX3ZfZ1wHT03HlIEMrWFQe0Qob9vz-tnGw8k8XTMCvR01cTj7gSZ7rZhFcWTecIoMjZk4TQTpB8AsNqYP13URbrwjAOtOtm-BS7Oo-QsYG6bSCsOmGurLkVyCqPjBl_PmplLOyDXW32zLEFrd-lSeeluDXzaAj3oucNMeEw6TjdI7kVuUKUQWiOXjcftJO2FPjzmOYlLovQd-PGBoTJdAFst1w416REN2uomY30lDYKjkF0ZKIdSG7UyxlmRXcXVxVeZSfpLEpedPH_0BgJhRkTvu-SSTb9wj3i-KHWx4fVyDIfAQou8ozHtA",
    "token_type": "Bearer",
    "refresh_token": "eyJraWQiOiI5YzU1OWEyMS03ZGM3LTRjNzgtYTBkMi03OWMxNGU1MjY5YjkiLCJ0eXAiOiJKV1QiLCJhbGciOiJSUzI1NiJ9.eyJzdWIiOiIxYTk1ZTU5ZS0zZGI3LTRhZmYtYjM5Ni1jNGM0NWJiZWRhNWYiLCJhdWQiOiJyZWdpc3RyYXRpb24iLCJzY29wZSI6ImJhbmtfYWNjb3VudDpzaG93IGJhbmtfYWNjb3VudF91c2Q6c2hvdyBjYXJkaG9sZGVyX3VzZXI6cmVhZCBjYXJkaG9sZGVyX3VzZXI6c2hvdyBjcnlwdG9fdG9fc2VwYTpzaG93IGRlcG9zaXRfY3J5cHRvOnNob3cgZXhjaGFuZ2U6c2hvdyBwYXlpbjpzaG93IHNlcGFfdG9fY3J5cHRvOnNob3cgdHJhbnNmZXJfb3RoZXI6Y3JlYXRlIHRyYW5zZmVyX293bjpjcmVhdGUgdXNlcl9tZmE6Y3JlYXRlIHVzZXJfbWZhOnJlYWQgd2l0aGRyYXdfY3J5cHRvOnNob3ciLCJpc3MiOiJodHRwczovL3BsYXRmb3JtLWFwaS5kZXYudGVzdGVzc2VudGlhbC5uZXQvcmVnIiwiZXhwIjoxNzcwOTcwNTY4LCJ0b2tlbl90eXBlIjoicmVmcmVzaCIsImlhdCI6MTc2ODM3ODU2OCwiZ3R5IjoiY2xpZW50LWNyZWRlbnRpYWxzIiwianRpIjoiYjRkMDc2ZDUtYjNhNC00NzRjLThlMGQtNzBmMGRlNTczZWFkIn0.NCCkHyy86-pmxJsWbeKEsrePI_qi0wLyubU_EZ0s57C-C8_R2BSdfASncPEjiwK8o2xeAiSGeLX9apgcFScdI8YrF3irt3N4zf11DYeLFwe4pMvX1xypRg3NSpgPNYJ3fDRSP5fs4Hzpbm68RXcpl8nTwjJ3CGau5e7jVl1qxfx1JiO84_ZqhKVJyWbNSBf7-tvfZ_UtWfrTaHv3crw49o69yZmTuPQuRljIPJACPU2pvvPW9ceDxQ_itk0VHv2wq3rN2eEP69YzhFJ8pltv4ZAszkSy-WuJ-ABWqX3klHhw8wWF_2XR0uugUG-lWdd_-YZHV7E2xapAjMrmbt83sg",
    "scope": "bank_account:show bank_account_usd:show cardholder_user:read cardholder_user:show crypto_to_sepa:show deposit_crypto:show exchange:show payin:show sepa_to_crypto:show transfer_other:create transfer_own:create user_mfa:create user_mfa:read withdraw_crypto:show",
    "expires_in": 604800,
    "user_id": "usr:1a95e59e-3db7-4aff-b396-c4c45bbeda5f"
}

This response provides an access_token that should be used for authenticated requests.


Sign in with Google

Step 1. Get Google Auth Url

Endpoint

GET /reg/v1/auth/google/url

Description

Retrieves a Google OAuth authorization URL to start the sign-in process for an existing user via Google account.

Headers

NameTypeRequiredDescription
partnerIdint32Partner ID provided by the Key Account Manager.
clientIdstringPlatform type where the application is installed (IOS/WEB/ANDROID).

Request Example

{        
    "partnerId": "6",
    "clientId": "IOS"  
}

Response Example

{
    "url": "https://accounts.google.com/o/oauth2/auth?access_type=online&client_id=594418530070-ejih71himddjvtmqtiugu40kcguf19as.apps.googleusercontent.com&redirect_uri=https://dev-app.vault.ist/&response_type=code&scope=openid%20email&state=5ca47a39-a265-4ab4-90ca-9eb5cc26af52&prompt=consent"
}

Step 2. Send Google Auth Details

Endpoint

POST /reg/v1/auth/google/token

Description

Exchanges the Google authorization code and state for an access token to authenticate the user in the system.

Headers

NameTypeRequiredDescription
partnerIdint32Partner ID provided by the Key Account Manager.
clientIdstringPlatform type where the application is installed (IOS/WEB/ANDROID).

Body Parameters

NameTypeRequiredDescription
codestringCode received after a user completes the Google authorization flow via the link provided in the initial request. Replace %2F symbols contained in the code with /.
statestringInformation received by the backend services after a user completes the Google authorization flow.

Request Example

{
  "code": "4/0ASc3gC3sMbhre7bsLuDSQ108D177yVzTCb0XXy_l847Yhk9QCm0P65kC2p1HcZSKHu8sZA",
  "state": "5ca47a39-a265-4ab4-90ca-9eb5cc26af52"
}

Response Example

{
    "access_token": "eyJraWQiOiI5YzU1OWEyMS03ZGM3LTRjNzgtYTBkMi03OWMxNGU1MjY5YjkiLCJ0eXAiOiJKV1QiLCJhbGciOiJSUzI1NiJ9.eyJodHRwczovL2V4Y2hhbmdlLnBpL2F1dGhvcml6YXRpb24vcm9sZXMiOlsiZXhwaTpwdG46OjY6cm9sZS9jbGllbnQiXSwic3ViIjoiMWE5NWU1OWUtM2RiNy00YWZmLWIzOTYtYzRjNDViYmVkYTVmIiwiYXVkIjoicmVnaXN0cmF0aW9uIiwic2NvcGUiOiJwYXlpbjpzaG93IGJhbmtfYWNjb3VudF91c2Q6c2hvdyB1c2VyX21mYTpjcmVhdGUgdHJhbnNmZXJfb3RoZXI6Y3JlYXRlIHRyYW5zZmVyX293bjpjcmVhdGUgY2FyZGhvbGRlcl91c2VyOnJlYWQgZXhjaGFuZ2U6c2hvdyB1c2VyX21mYTpyZWFkIGRlcG9zaXRfY3J5cHRvOnNob3cgY3J5cHRvX3RvX3NlcGE6c2hvdyBjYXJkaG9sZGVyX3VzZXI6c2hvdyB3aXRoZHJhd19jcnlwdG86c2hvdyBiYW5rX2FjY291bnQ6c2hvdyBzZXBhX3RvX2NyeXB0bzpzaG93IiwiaXNzIjoiaHR0cHM6Ly9wbGF0Zm9ybS1hcGkuZGV2LnRlc3Rlc3NlbnRpYWwubmV0L3JlZyIsImV4cCI6MTc2ODQ2NTM0NCwidG9rZW5fdHlwZSI6ImFjY2VzcyIsImlhdCI6MTc2ODM3ODk0NCwiZ3R5IjoiY2xpZW50LWNyZWRlbnRpYWxzIiwianRpIjoiNmI3ZjVmOTUtOWEyMy00ZGIyLThhOWItNDY0YzliNGMwN2U3In0.aaC2GTn_KxdBVolRtcsFUFuWux1AbU8CeXBnEi1E41UFK9To4B0mcD9PIqCYTv2Nl-5zsRRK2bazlDPLX7-mLbUSQMp16dHkScEuZHJZ6GAGNwJYWOL85e0x4MsHSWcvbrmu7elZsxcm8J2XPCV23qf8uUkBmLr9yrnObNcDx-P5aiCwGfvySm2sTF5eMGiw58fOaRUTl8cC36x_ebGLOLdZ-hbI9MyVauvQUu44DDqKBisAwn78SKp7mDRay4ti6m8AuQon4-G1Jo0P5IzofOA8qUOTe1pnsRsHOnie2eg2Ttcj_lJjpbUiwnxufc2750oSAPxW8OmHYOKLzorPRw",
    "token_type": "Bearer",
    "refresh_token": "eyJraWQiOiI5YzU1OWEyMS03ZGM3LTRjNzgtYTBkMi03OWMxNGU1MjY5YjkiLCJ0eXAiOiJKV1QiLCJhbGciOiJSUzI1NiJ9.eyJzdWIiOiIxYTk1ZTU5ZS0zZGI3LTRhZmYtYjM5Ni1jNGM0NWJiZWRhNWYiLCJhdWQiOiJyZWdpc3RyYXRpb24iLCJzY29wZSI6InBheWluOnNob3cgYmFua19hY2NvdW50X3VzZDpzaG93IHVzZXJfbWZhOmNyZWF0ZSB0cmFuc2Zlcl9vdGhlcjpjcmVhdGUgdHJhbnNmZXJfb3duOmNyZWF0ZSBjYXJkaG9sZGVyX3VzZXI6cmVhZCBleGNoYW5nZTpzaG93IHVzZXJfbWZhOnJlYWQgZGVwb3NpdF9jcnlwdG86c2hvdyBjcnlwdG9fdG9fc2VwYTpzaG93IGNhcmRob2xkZXJfdXNlcjpzaG93IHdpdGhkcmF3X2NyeXB0bzpzaG93IGJhbmtfYWNjb3VudDpzaG93IHNlcGFfdG9fY3J5cHRvOnNob3ciLCJpc3MiOiJodHRwczovL3BsYXRmb3JtLWFwaS5kZXYudGVzdGVzc2VudGlhbC5uZXQvcmVnIiwiZXhwIjoxNzcwOTcwOTQ0LCJ0b2tlbl90eXBlIjoicmVmcmVzaCIsImlhdCI6MTc2ODM3ODk0NCwiZ3R5IjoiY2xpZW50LWNyZWRlbnRpYWxzIiwianRpIjoiNmI3ZjVmOTUtOWEyMy00ZGIyLThhOWItNDY0YzliNGMwN2U3In0.nT1JmFLyhZ1ScVR_gBDDEfwzR4PXDywaO3lSoWiOyLoxeAvwnBLfa1mFBKPbyToQoE6bxUm-nKSd6vx9P75jQfGvPBZ7QDmNkY71QhKQJxSzH_NF8tku7oPdaneNFNDUiO4tCwix-PfbYtH42H1LHFysgc8voyo-rsQb-OP2i8bFXjKl2V0-xViqcJrFrm0rr06a4Dvfsz86rHYEbE9vuq4d3JGuubbhkMi50HYwPIi9cmn3sTQcj2Igl3TJTO1r00zsuvbzj3kGTURKxxyVms_UZvEwjJc5W6z_BCMoQS_i0KLSBvGWwKwfypJ_HcdwDJ0VWupUeycmqBR3g5L9eQ",
    "scope": "payin:show bank_account_usd:show user_mfa:create transfer_other:create transfer_own:create cardholder_user:read exchange:show user_mfa:read deposit_crypto:show crypto_to_sepa:show cardholder_user:show withdraw_crypto:show bank_account:show sepa_to_crypto:show",
    "expires_in": 604800,
    "user_id": "usr:1a95e59e-3db7-4aff-b396-c4c45bbeda5f"
}

The 424 ERROR response and the authentication token will be returned, the confirmation code will be sent to the user's email. Then use the endpoint below for 2FA authorization code verification.


Optional Step. Confirm Google 2FA

Endpoint:

POST /reg/v1/auth/google/mfa/confirm

Description

Verifies the multi-factor authentication code for Google sign-in and returns an access token upon successful confirmation.

Headers

NameTypeRequiredDescription
partnerIdint32Partner ID provided by the Key Account Manager.

Body Parameters

NameTypeRequiredDescription
mfaCodestringConfirmation code sent to the user's email.
mfaTokenstringA multi-factor authentication token used to handle 2FA workflow.

Request Example

{
  "mfaCode": "123456",
  "mfaToken": "f1303577-9fd9-4220-8cca-a813cd4d7b40"
}

Response Example

{
    "access_token": "eyJraWQiOiI5YzU1OWEyMS03ZGM3LTRjNzgtYTBkMi03OWMxNGU1MjY5YjkiLCJ0eXAiOiJKV1QiLCJhbGciOiJSUzI1NiJ9.eyJodHRwczovL2V4Y2hhbmdlLnBpL2F1dGhvcml6YXRpb24vcm9sZXMiOlsiZXhwaTpwdG46OjY6cm9sZS9jbGllbnQiXSwic3ViIjoiMWE5NWU1OWUtM2RiNy00YWZmLWIzOTYtYzRjNDViYmVkYTVmIiwiYXVkIjoicmVnaXN0cmF0aW9uIiwic2NvcGUiOiJwYXlpbjpzaG93IGJhbmtfYWNjb3VudF91c2Q6c2hvdyB1c2VyX21mYTpjcmVhdGUgdHJhbnNmZXJfb3RoZXI6Y3JlYXRlIHRyYW5zZmVyX293bjpjcmVhdGUgY2FyZGhvbGRlcl91c2VyOnJlYWQgZXhjaGFuZ2U6c2hvdyB1c2VyX21mYTpyZWFkIGRlcG9zaXRfY3J5cHRvOnNob3cgY3J5cHRvX3RvX3NlcGE6c2hvdyBjYXJkaG9sZGVyX3VzZXI6c2hvdyB3aXRoZHJhd19jcnlwdG86c2hvdyBiYW5rX2FjY291bnQ6c2hvdyBzZXBhX3RvX2NyeXB0bzpzaG93IiwiaXNzIjoiaHR0cHM6Ly9wbGF0Zm9ybS1hcGkuZGV2LnRlc3Rlc3NlbnRpYWwubmV0L3JlZyIsImV4cCI6MTc2ODQ2NjEzMywidG9rZW5fdHlwZSI6ImFjY2VzcyIsImlhdCI6MTc2ODM3OTczMywiZ3R5IjoiY2xpZW50LWNyZWRlbnRpYWxzIiwianRpIjoiNDcwNTZiMzMtZjliOS00NzEzLWFkMmMtNGIxOGRiY2Q2NmMwIn0.CA2QRNqSu77Gl0AONOSPaFJgpyfACiSUxGUI7IYhi6GVxitrwsMlzRS1m-_9xMt1sP4o44GMkRmvksoph-tj35DggswckmbunHQh-LV-z3sYnnlfTjOeeViVICcROxMEtWl5j9jTgCAO0rgJn8Ko1Hgg4Ea0EY5H6iKkHh_B41o8044Ik_IVf5tN1997ErEo1xiqcmOaw8si15Vcq2JDVVd_NOeXe3oMcIhgWQ0psjX1apoo6UOXRwSSRgbpVg-l2s0tCCOyQh-3kaOfjGeOT3-24ypP2BT_BEO1NxylOtiGHJz5F3QNYdXtXJHacHWrXADoG3d4NJu6ixMEGBc35A",
    "token_type": "Bearer",
    "refresh_token": "eyJraWQiOiI5YzU1OWEyMS03ZGM3LTRjNzgtYTBkMi03OWMxNGU1MjY5YjkiLCJ0eXAiOiJKV1QiLCJhbGciOiJSUzI1NiJ9.eyJzdWIiOiIxYTk1ZTU5ZS0zZGI3LTRhZmYtYjM5Ni1jNGM0NWJiZWRhNWYiLCJhdWQiOiJyZWdpc3RyYXRpb24iLCJzY29wZSI6InBheWluOnNob3cgYmFua19hY2NvdW50X3VzZDpzaG93IHVzZXJfbWZhOmNyZWF0ZSB0cmFuc2Zlcl9vdGhlcjpjcmVhdGUgdHJhbnNmZXJfb3duOmNyZWF0ZSBjYXJkaG9sZGVyX3VzZXI6cmVhZCBleGNoYW5nZTpzaG93IHVzZXJfbWZhOnJlYWQgZGVwb3NpdF9jcnlwdG86c2hvdyBjcnlwdG9fdG9fc2VwYTpzaG93IGNhcmRob2xkZXJfdXNlcjpzaG93IHdpdGhkcmF3X2NyeXB0bzpzaG93IGJhbmtfYWNjb3VudDpzaG93IHNlcGFfdG9fY3J5cHRvOnNob3ciLCJpc3MiOiJodHRwczovL3BsYXRmb3JtLWFwaS5kZXYudGVzdGVzc2VudGlhbC5uZXQvcmVnIiwiZXhwIjoxNzcwOTcxNzMzLCJ0b2tlbl90eXBlIjoicmVmcmVzaCIsImlhdCI6MTc2ODM3OTczMywiZ3R5IjoiY2xpZW50LWNyZWRlbnRpYWxzIiwianRpIjoiNDcwNTZiMzMtZjliOS00NzEzLWFkMmMtNGIxOGRiY2Q2NmMwIn0.PP7BLolV6viy6bkKyGiKHgbFma5MmShLCgWDua5o4xxlOR7pShHQat0n5fnVolJ_wlYqoNJuOcOhfc_nEth3mYrKM8geu3yFchzU6J_4xT0-tWUsbFK9Xz3TtqgXi-bpIF57ANqhJpkYKA0YrVT80yHJTsE44IBawmJoycrO43n-Y94uuvnPNnCmzVwnGE-cgO3gEbenHQZ9LBoTDfgnBJM4cwVdydz-0_Kyiu0AMHcfYuHA1IB2DgCremYO7faSGIPgqrzuiEuEvlG_ZUGTc4BUdg1EYCBnBfvuolB791eC_qfC_Ke2VWiW--HmwhLWJueGHOY_lvN3h-3dsPjPWQ",
    "scope": "payin:show bank_account_usd:show user_mfa:create transfer_other:create transfer_own:create cardholder_user:read exchange:show user_mfa:read deposit_crypto:show crypto_to_sepa:show cardholder_user:show withdraw_crypto:show bank_account:show sepa_to_crypto:show",
    "expires_in": 604800,
    "user_id": "usr:1a95e59e-3db7-4aff-b396-c4c45bbeda5f"
}

Step 3. Set Password

When registering via Google, the account will not have a password. It can be set later in the user profile to access the app using the standard login and password combination.

Endpoint

POST /reg/v2/password/set

Description

Sets or updates the password for a user account registered via Google authentication.

🚧

Password Requirements

  • Length 10 to 32 characters.
  • Only Latin letters.
  • Must contain at least 1 number.
  • Must contain at least 1 symbol (e.g., !, @, #, $).
  • Must include at least 1 uppercase and 1 lowercase letter.
  • A weak password (e.g., including qwerty or 12345 combinations) will not be accepted.

Body Parameters

NameTypeRequiredDescription
newPasswordstringNew password to be set.

Request Example

{
  "newPassword": "aVogaghjfsa89gds!!"
}

Response Example

{
  "result": "ok"
}

Purchase a Subscription

Once registration and verification steps are completed, the user should be offered to opt a subscription.
Subscriptions provide recurring access to services based on different tiers.

To integrate and manage subscriptions, refer to the full Subscription Guide.