Skip to content

Authentication

REST API V3

This authentication guide is for users working on REST API accounts already mapped to OMS V3.

Use the environment URL that matches the account mapping you have been enabled on. In most rollout cases, teams validate first on UAT and then switch the same V3 flow to PROD after the production account has been mapped.

Nubra Auth Flow

API Endpoints

Environment Base URL
PROD https://api.nubra.io
UAT https://uatapi.nubra.io

Step 1: Generate Temporary Token

Initiates the login flow and returns a temp_token. This token is required for the OTP request in the next step.

Method: POST
Endpoint: /sendphoneotp

cURL

curl --location 'https://api.nubra.io/sendphoneotp' \
--header 'Content-Type: application/json' \
--data '{
  "phone": "0000000000",
  "skip_totp": false
}'

Payload

{
  "phone": "0000000000",
  "skip_totp": false
}

Response

{
  "attempts_left": 4,
  "email": "xyz@gmail.com",
  "expiry": 30,
  "flow": "LOGIN",
  "message": "OTP sent",
  "next": "VERIFY_MOBILE",
  "phone": "0000000000",
  "temp_token": "eyJh...zd0"
}

Save the temp_token from this response. This token must be passed in the x-temp-token header in Step 2. Also choose the x-device-id to be used for this login session, for example 12345mac or TS123.

Step 2: Send OTP

Uses the temp_token from Step 1 to generate and send the OTP required for login.

Method: POST
Endpoint: /sendphoneotp

cURL

curl --location 'https://api.nubra.io/sendphoneotp' \
--header 'x-temp-token: eyJh...zd0' \
--header 'Content-Type: application/json' \
--data '{
  "phone": "0000000000",
  "skip_totp": true
}'

Headers

  • x-temp-token: temp_token returned in Step 1

Payload

{
  "phone": "0000000000",
  "skip_totp": true
}

Response

{
  "attempts_left": 4,
  "email": "xyz@gmail.com",
  "expiry": 30,
  "flow": "LOGIN",
  "message": "OTP sent",
  "next": "VERIFY_MOBILE",
  "phone": "0000000000",
  "temp_token": "eyJh...zd0"
}

Save the new temp_token returned in this response. This updated token must be used during OTP verification in Step 3.

Step 3: Verify OTP

Validates the OTP received on the registered mobile number. Use the latest temp_token and the same x-device-id selected for this login session.

Method: POST
Endpoint: /verifyphoneotp

cURL

curl --location 'https://api.nubra.io/verifyphoneotp' \
--header 'x-temp-token: eyJh...zd0' \
--header 'x-device-id: TS123' \
--header 'Content-Type: application/json' \
--data '{
  "phone": "0000000000",
  "otp": "341874"
}'

Headers

  • x-temp-token: Latest temp_token returned by the previous step
  • x-device-id: Device identifier selected for this login session, for example TS123

Payload

{
  "phone": "0000000000",
  "otp": "341874"
}

Response

{
  "auth_token": "7a1171e6-790c-40fa-ae16-b71cfd19923f",
  "flow": "LOGIN",
  "message": "User Created Successfully",
  "next": "ENTER_MPIN"
}

Save the auth_token. This token is used as the Bearer token in Step 4.

Step 4: Verify PIN

Validates the user's MPIN and returns the final authenticated session.

Method: POST
Endpoint: /verifypin

cURL

curl --location 'https://api.nubra.io/verifypin' \
--header 'x-device-id: TS123' \
--header 'Content-Type: application/json' \
--header 'Authorization: Bearer 7a1171e6-790c-40fa-ae16-b71cfd19923f' \
--data '{
  "pin": "1234"
}'

Authorization

  • Type: Bearer Token
  • Token: auth_token returned in Step 3

Headers

  • x-device-id: Same device ID used in Step 3
  • x-temp-token: Do not include this header in this request

Payload

{
  "pin": "1234"
}

Response

{
  "email": "xyz@gmail.com",
  "message": "Login Successful",
  "next": "DASHBOARD",
  "phone": "0000000000",
  "session_token": "eyJh...6Pno",
  "userId": 224
}

The session_token returned in this response is the final login token. Use it as the Bearer token for authenticated REST APIs such as market data, trading, portfolio, and account endpoints. If static IP access is enabled for the account, call Static IP Validation after login to verify the current outbound IP before sending trading requests.

Authenticated Request Headers

For authenticated REST API calls on OMS V3-mapped accounts, use the same REST header style as the main REST API track:

  • Authorization: Bearer <session_token>
  • x-device-id: <device_id>

Include Content-Type: application/json when the request sends a JSON body.

TOTP Authentication

The TOTP login flow is a secondary authentication method that can be enabled or disabled after a client has logged in. Once logged in, the client receives a session token, which is used as a bearer token to initiate the TOTP login flow.

Step 1: Generate TOTP Secret

Method: GET
Endpoint: /totp/generate-secret

cURL

curl --location 'https://api.nubra.io/totp/generate-secret' \
--header 'Authorization: Bearer {{session_token}}' \
--header 'x-device-id: {{device_id}}'

Headers

  • Authorization: Bearer session_token (from first-time login)
  • x-device-id: Your device ID (e.g., TS123)

Response

{
  "data": {
    "secret_key": "BTZYQ6WQ3XSHXOWEMIZC5FTDKB6ODQJP",
    "qr_image": "data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAgAAAAIAAQMAAADOtka5AAAABlBMVEX///8AAABVwtN+R2mIrU++xzyRmap3jAAA4AlIkbD0EV8bHCc/0AsLCwsL5ErkJggg=="
  },
  "message": "Enable TOTP flow by verifying TOTP"
}

This endpoint returns a TOTP secret. 

 The client must save this secret and add it to an Authenticator App (e.g., Google      Authenticator or any other preferred TOTP-compatible app).

Step 2: Enable TOTP

Method: POST
Endpoint: /totp/enable

cURL

curl --location 'https://api.nubra.io/totp/enable' \
--header 'Authorization: Bearer {{session_token}}' \
--header 'x-device-id: {{device_id}}' \
--header 'Content-Type: application/json' \
--data '{
  "mpin": "1234",
  "totp": "123456"
}'

Payload

{
  "mpin": "1234",
  "totp": "1234"
}

Response

{
    "message": "TOTP verified successfully"
}

Step 3: Login via TOTP

Method: POST
Endpoint: /totp/login

cURL

curl --location 'https://api.nubra.io/totp/login' \
--header 'x-device-id: {{device_id}}' \
--header 'Content-Type: application/json' \
--data '{
  "phone": "0000000000",
  "totp": "847851",
  "otp": ""
}'

Payload

{
  "phone": "0000000000",
  "totp": "307215",
  "otp": ""
}

TOTP value type

Send totp as a string. Numeric values can fail request parsing.

Response

{
    "auth_token": "40e10d2e-fe48-4651-becb-7a97261d63cc",
    "flow": "LOGIN",
    "message": "User Created Successfully",
    "next": "ENTER_MPIN"
}

Step 4: Verify PIN

Method: POST
Endpoint: /verifypin

cURL

curl --location 'https://api.nubra.io/verifypin' \
--header 'x-device-id: {{device_id}}' \
--header 'Authorization: Bearer 7a1171e6-790c-40fa-ae16-b71cfd19923f' \
--header 'Content-Type: application/json' \
--data '{
  "pin": "1234"
}'

Payload

{
  "pin": "1234"
}

Response

{
    "email": "kavya@zanskar.xyz",
    "message": "Login Successful",
    "next": "DASHBOARD",
    "phone": "000000000",
    "session_token": "eyJhbGciOi...Dz5T5dMRgY",
    "userId": 35
}

Use this session token for accessing all protected APIs.

Disable TOTP

Method: POST
Endpoint: /totp/disable

cURL

curl --location 'https://api.nubra.io/totp/disable' \
--header 'Authorization: Bearer {{session_token}}' \
--header 'x-device-id: {{device_id}}' \
--header 'Content-Type: application/json' \
--data '{
  "mpin": "1234"
}'

Payload

{
  "mpin": "1234"
}

Response

{
  "message": "Disabled TOTP successfully"
}
NEO Assistant