AUTHENTICATION V1

Authentication

Public IFSC, GST, HSN, and SAC calls use a Developer Console API key on https://mantechstudio.in/api/v1. That is not the same as console sign-in and not the same as /external/v1 on the API platform host.

Manage API Keys API Playground

Available in TEST·Live in TEST on https://mantechstudio.in/api/v1 using Developer Console keys (Authorization: Bearer mantech_test_…). /external/v1 is a different credential store.

Which credential to send

Use case	Credential	Host + path
Playground, curl, IFSC / GST / HSN / SAC	mantech_test_… or mantech_live_…	mantechstudio.in/api/v1/…
Developer Console (keys, apps, usage)	Firebase ID token after email/Google sign-in	/api/v1/developer/**
Programmatic user login (platform JWT)	Email + password → idToken / refreshToken	/api/v1/auth/*

Send console API keys as Authorization: Bearer …. X-API-Key is also accepted on public data APIs.
Copy the secret once at create or rotate. The masked prefix in the console is not a working key.
Do not send a console TEST key to /external/v1 or https://mantech-api-platform.web.app. That host uses a different credential store and returns INVALID_API_CREDENTIAL.
Do not send an API key to /api/v1/developer/**, and do not send a Firebase ID token to IFSC, GST, HSN, or SAC.

Public data API (placeholder TEST key — not a real secret)

curl "https://mantechstudio.in/api/v1/ifsc/SBIN0000691" \
  -H "Authorization: Bearer mantech_test_0123456789abcdef.example_secret"

Console keys

Bound to one application and TEST or LIVE. Environment is selected by the verified secret, not by a separate sandbox host.

Platform JWT

/api/v1/auth/* mints Firebase-backed id and refresh tokens for user sessions. Those tokens are not playground API keys.

POST/api/v1/auth/login

Authenticate a platform user with email and password. Success envelope is { data, meta, requestId } (no success field). This does not create a Developer Console API key.

cURL

curl -X POST "https://mantechstudio.in/api/v1/auth/login" \
  -H "Content-Type: application/json" \
  -d '{
    "email": "developer@example.com",
    "password": "SecurePassword123!"
  }'

JavaScript fetch

const res = await fetch('https://mantechstudio.in/api/v1/auth/login', {
  method: 'POST',
  headers: { 'Content-Type': 'application/json' },
  body: JSON.stringify({
    email: 'developer@example.com',
    password: 'SecurePassword123!'
  })
});
const body = await res.json();
console.log(body.data.idToken, body.data.refreshToken, body.requestId);

Example 200 response body

{
  "data": {
    "userId": "usr_9a4f21b7e0c4",
    "uid": "usr_9a4f21b7e0c4",
    "idToken": "eyJhbGciOiJSUzI1NiIsImtpZCI6Ij...",
    "refreshToken": "AEu4IL0kZ9_...",
    "expiresIn": "3600"
  },
  "meta": {
    "timestamp": "2026-09-20T12:00:00.000Z"
  },
  "requestId": "b72e01df-3481-42ab-8e01-9f9b5a037df1"
}

POST/api/v1/auth/signup

Register a platform user. Password must be at least 6 characters. Duplicate emails return HTTP 409 (AUTH_EMAIL_ALREADY_EXISTS). Weak passwords return HTTP 400 (AUTH_WEAK_PASSWORD).

cURL

curl -X POST "https://mantechstudio.in/api/v1/auth/signup" \
  -H "Content-Type: application/json" \
  -d '{
    "email": "newdev@example.com",
    "password": "SecurePassword123!",
    "displayName": "New Developer"
  }'

Example 201 response body

{
  "data": {
    "userId": "usr_d87a192c091e",
    "uid": "usr_d87a192c091e",
    "idToken": "eyJhbGciOiJSUzI1NiIsImtpZCI6Ij...",
    "refreshToken": "AEu4IL38kd_...",
    "expiresIn": "3600",
    "profile": {
      "displayName": "New Developer"
    }
  },
  "meta": {
    "timestamp": "2026-09-20T12:00:00.000Z"
  },
  "requestId": "f4209bb7-1834-45aa-9631-01ec6fa034e9"
}

POST/api/v1/auth/refresh

Exchange a valid refresh token for a new id token and rotated refresh token.

cURL

curl -X POST "https://mantechstudio.in/api/v1/auth/refresh" \
  -H "Content-Type: application/json" \
  -d '{
    "refreshToken": "AEu4IL0kZ9_..."
  }'

Example 200 response body

{
  "data": {
    "userId": "usr_9a4f21b7e0c4",
    "uid": "usr_9a4f21b7e0c4",
    "idToken": "eyJhbGciOiJSUzI1NiIsImtpZCI6Ij...",
    "refreshToken": "AEu4IL99xx_...",
    "expiresIn": "3600"
  },
  "meta": {
    "timestamp": "2026-09-20T12:00:00.000Z"
  },
  "requestId": "5a0280f2-ecbf-4f27-a068-190367bfd3e1"
}

POST/api/v1/auth/logout

Revoke the caller's refresh sessions. Requires Authorization: Bearer <idToken> from login/signup/refresh — not an API key.

cURL

curl -X POST "https://mantechstudio.in/api/v1/auth/logout" \
  -H "Authorization: Bearer eyJhbGciOiJSUzI1NiIsImtpZCI6Ij..."

Example 200 response body

{
  "data": {
    "ok": true,
    "scope": "all_sessions"
  },
  "meta": {
    "timestamp": "2026-09-20T12:00:00.000Z"
  },
  "requestId": "81819c92-3642-4f01-900a-28e469da3b2c"
}

POST/api/v1/auth/password-reset

Request recovery for an email. The response does not disclose whether the address exists.

cURL

curl -X POST "https://mantechstudio.in/api/v1/auth/password-reset" \
  -H "Content-Type: application/json" \
  -d '{ "email": "developer@example.com" }'

Authentication error codes

Status	Code	Description
400	VALIDATION_ERROR	Missing email, password, or refreshToken.
400	AUTH_WEAK_PASSWORD	Password shorter than 6 characters on signup.
401	invalid_api_key	Public /api/v1 data API: console key missing, malformed, revoked, or not the secret shown once.
401	INVALID_API_CREDENTIAL	You sent a console key (or no key) to /external/v1 / the API platform host. Use /api/v1 on mantechstudio.in instead.
401	AUTH_INVALID_CREDENTIALS	Incorrect email or password on /api/v1/auth/login.
401	UNAUTHENTICATED	Logout called without a valid Bearer idToken.
409	AUTH_EMAIL_ALREADY_EXISTS	Signup email is already registered.
429	AUTH_RATE_LIMIT_EXCEEDED	Too many auth attempts from this IP.

Loading…

Which credential to send

Use case	Credential	Host + path
Playground, curl, IFSC / GST / HSN / SAC	mantech_test_… or mantech_live_…	mantechstudio.in/api/v1/…
Developer Console (keys, apps, usage)	Firebase ID token after email/Google sign-in	/api/v1/developer/**
Programmatic user login (platform JWT)	Email + password → idToken / refreshToken	/api/v1/auth/*

Send console API keys as Authorization: Bearer …. X-API-Key is also accepted on public data APIs.

Copy the secret once at create or rotate. The masked prefix in the console is not a working key.

Do not send a console TEST key to /external/v1 or https://mantech-api-platform.web.app. That host uses a different credential store and returns INVALID_API_CREDENTIAL.

Do not send an API key to /api/v1/developer/**, and do not send a Firebase ID token to IFSC, GST, HSN, or SAC.

Public data API (placeholder TEST key — not a real secret)

curl "https://mantechstudio.in/api/v1/ifsc/SBIN0000691" \
  -H "Authorization: Bearer mantech_test_0123456789abcdef.example_secret"

const res = await fetch('https://mantechstudio.in/api/v1/auth/login', { method: 'POST', headers: { 'Content-Type': 'application/json' }, body: JSON.stringify({ email: 'developer@example.com', password: 'SecurePassword123!' }) }); const body = await res.json(); console.log(body.data.idToken, body.data.refreshToken, body.requestId);

{ "data": { "userId": "usr_9a4f21b7e0c4", "uid": "usr_9a4f21b7e0c4", "idToken": "eyJhbGciOiJSUzI1NiIsImtpZCI6Ij...", "refreshToken": "AEu4IL0kZ9_...", "expiresIn": "3600" }, "meta": { "timestamp": "2026-09-20T12:00:00.000Z" }, "requestId": "b72e01df-3481-42ab-8e01-9f9b5a037df1" }

curl -X POST "https://mantechstudio.in/api/v1/auth/signup" \ -H "Content-Type: application/json" \ -d '{ "email": "newdev@example.com", "password": "SecurePassword123!", "displayName": "New Developer" }'

{ "data": { "userId": "usr_d87a192c091e", "uid": "usr_d87a192c091e", "idToken": "eyJhbGciOiJSUzI1NiIsImtpZCI6Ij...", "refreshToken": "AEu4IL38kd_...", "expiresIn": "3600", "profile": { "displayName": "New Developer" } }, "meta": { "timestamp": "2026-09-20T12:00:00.000Z" }, "requestId": "f4209bb7-1834-45aa-9631-01ec6fa034e9" }

{ "data": { "userId": "usr_9a4f21b7e0c4", "uid": "usr_9a4f21b7e0c4", "idToken": "eyJhbGciOiJSUzI1NiIsImtpZCI6Ij...", "refreshToken": "AEu4IL99xx_...", "expiresIn": "3600" }, "meta": { "timestamp": "2026-09-20T12:00:00.000Z" }, "requestId": "5a0280f2-ecbf-4f27-a068-190367bfd3e1" }

Status

Code

Description

400

VALIDATION_ERROR

Missing email, password, or refreshToken.

400

AUTH_WEAK_PASSWORD

Password shorter than 6 characters on signup.

401

invalid_api_key

Public /api/v1 data API: console key missing, malformed, revoked, or not the secret shown once.

401

INVALID_API_CREDENTIAL

You sent a console key (or no key) to /external/v1 / the API platform host. Use /api/v1 on mantechstudio.in instead.

401

AUTH_INVALID_CREDENTIALS

Incorrect email or password on /api/v1/auth/login.

401

UNAUTHENTICATED

Logout called without a valid Bearer idToken.

409

AUTH_EMAIL_ALREADY_EXISTS

Signup email is already registered.

429

AUTH_RATE_LIMIT_EXCEEDED

Too many auth attempts from this IP.