staff.auth

9 methods on staff.auth. Each returns the answer's data and throws NoviqaError on a failed answer.

changePassword

POST/admin/v1/auth/change-password

Change the own password (staff)

Needs the current password. The new one must be 8-16 characters with a lower case letter, an upper case letter, a digit and a symbol, and differ from the current one. Closes every session of the login: sign in again.

Request body

current_passwordstring

new_passwordstring

Returns

Promise<null>

The answer's data.

Errors

400auth.password_same: new password must differ from the current one

400auth.password_weak: password must be 8-16 characters with a lower, upper, digit and symbol

400invalid_input: invalid input

401auth.invalid_credentials: wrong login or password

401auth.session_expired: session expired, sign in again

403auth.csrf_invalid: request refused: reload the page and try again

403auth.invalid_terminal: this terminal cannot be used here

403auth.otp_enrol_required: your group requires one-time codes: set them up to continue

403auth.password_change_not_allowed: password change is not allowed for this account

403auth.password_change_required: you must change your password first

429auth.too_many_attempts: too many attempts, try again later

500internal: something went wrong

SDKcURL

import { staff } from "@/lib/noviqa"

const data = await staff.auth.changePassword({
  current_password: "string",
  new_password: "string"
})

bash

curl -X POST "$NOVIQA_API_URL/admin/v1/auth/change-password" \
  -H "Authorization: Bearer $NOVIQA_TOKEN" \
  -H "Content-Type: application/json" \
  --data-raw '{
  "current_password": "string",
  "new_password": "string"
}'

Response 200

json

{
  "success": true,
  "code": "ok",
  "message": "done",
  "data": null,
  "request_id": "5b7f2c1e"
}

staff.auth.changePassword(body: http.changePasswordRequest, options?: RequestOptions): Promise<null>

POST/admin/v1/auth/login

Checks login and password and opens a session. Browser terminals (web, admin, manager) get HttpOnly cookies and the csrf_token to echo in X-CSRF-Token; other terminals get access_token and refresh_token for the Authorization header. If the answer is auth.otp_required, send the same request again with otp. A session with must_change_password or must_enrol_otp may only do that (see the guide). Failed attempts are counted per login and address and end in auth.too_many_attempts for a while. Staff terminals: admin, manager (default manager); trader terminals: web (default), android, ios, desktop, api.

Request body

keep_signed_inboolean

logininteger

otpstring

passwordstring

terminalany

Returns

Promise<tokensView>

The answer's data.

Errors

400invalid_input: invalid input

401auth.invalid_credentials: wrong login or password

401auth.otp_invalid: wrong one-time code

401auth.otp_not_set: set up one-time codes to continue

401auth.otp_required: enter the one-time code from your authenticator app

403auth.account_disabled: account is disabled

403auth.invalid_terminal: this terminal cannot be used here

403auth.ip_not_allowed: sign-in from this address is not allowed

403auth.not_staff: account is not set up for staff access

403auth.terminal_not_allowed: this terminal is not allowed for the account

403forbidden: you do not have access to this action

429auth.too_many_attempts: too many attempts, try again later

500internal: something went wrong

SDKcURL

import { staff } from "@/lib/noviqa"

const data = await staff.auth.login({
  login: 1000,
  password: "Adm1n#Pass",
  terminal: "admin"
})

bash

curl -X POST "$NOVIQA_API_URL/admin/v1/auth/login" \
  -H "Authorization: Bearer $NOVIQA_TOKEN" \
  -H "Content-Type: application/json" \
  --data-raw '{
  "login": 1000,
  "password": "Adm1n#Pass",
  "terminal": "admin"
}'

Response 200

json

{
  "success": true,
  "code": "ok",
  "message": "done",
  "data": {
    "access_expires_at": "2026-09-25T10:15:00Z",
    "access_token": "string",
    "csrf_token": "string",
    "refresh_token": "string",
    "session": {
      "csrf_token": "string",
      "expires_at": "2026-09-25T10:15:00Z",
      "group": "real\\standard",
      "group_scope": [
        "string"
      ],
      "keep_signed_in": true,
      "login": 1001,
      "must_change_password": true,
      "must_enrol_otp": true,
      "read_only": true,
      "rights": [
        "string"
      ],
      "server_clock": {
        "daylight_saving": "none",
        "utc_offset_min": 1
      },
      "terminal": "web"
    },
    "session_expires_at": "2026-09-25T10:15:00Z"
  },
  "request_id": "5b7f2c1e"
}

staff.auth.login(body: http.loginRequest, options?: RequestOptions): Promise<http.tokensView>

logout

POST/admin/v1/auth/logout

Sign out (staff)

Closes the session and then clears the cookies. If browser access has expired, the still-live refresh cookie can authenticate this revocation only, without rotating it; X-CSRF-Token remains required. Failed revocation does not clear cookies or claim sign-out success.

Returns

Promise<null>

The answer's data.

Errors

401auth.session_expired: session expired, sign in again

403auth.csrf_invalid: request refused: reload the page and try again

403auth.invalid_terminal: this terminal cannot be used here

403auth.otp_enrol_required: your group requires one-time codes: set them up to continue

403auth.password_change_required: you must change your password first

500internal: something went wrong

SDKcURL

import { staff } from "@/lib/noviqa"

const data = await staff.auth.logout()

bash

curl -X POST "$NOVIQA_API_URL/admin/v1/auth/logout" \
  -H "Authorization: Bearer $NOVIQA_TOKEN"

Response 200

json

{
  "success": true,
  "code": "ok",
  "message": "done",
  "data": null,
  "request_id": "5b7f2c1e"
}

staff.auth.logout(options?: RequestOptions): Promise<null>

me

GET/admin/v1/auth/me

The signed-in session (staff)

Who is signed in, what they must do first (must_change_password, must_enrol_otp), staff rights and group scope, and the csrf token. expires_at is the session end; access_expires_at is the verified access token's expiry, so a reloaded page can schedule its refresh. Allowed to restricted sessions.

Returns

Promise<currentSessionView>

The answer's data.

Errors

401auth.session_expired: session expired, sign in again

403auth.invalid_terminal: this terminal cannot be used here

403auth.otp_enrol_required: your group requires one-time codes: set them up to continue

403auth.password_change_required: you must change your password first

500internal: something went wrong

SDKcURL

import { staff } from "@/lib/noviqa"

const data = await staff.auth.me()

bash

curl -X GET "$NOVIQA_API_URL/admin/v1/auth/me" \
  -H "Authorization: Bearer $NOVIQA_TOKEN"

Response 200

json

{
  "success": true,
  "code": "ok",
  "message": "done",
  "data": {
    "access_expires_at": "2026-09-25T10:15:00Z",
    "csrf_token": "string",
    "expires_at": "2026-09-25T10:15:00Z",
    "group": "real\\standard",
    "group_scope": [
      "string"
    ],
    "keep_signed_in": true,
    "login": 1001,
    "must_change_password": true,
    "must_enrol_otp": true,
    "read_only": true,
    "rights": [
      "string"
    ],
    "server_clock": {
      "daylight_saving": "none",
      "utc_offset_min": 1
    }
  },
  "request_id": "5b7f2c1e"
}

staff.auth.me(options?: RequestOptions): Promise<http.currentSessionView>

otp

GET/admin/v1/auth/otp

One-time code status (staff)

Whether one-time codes are on for the login and whether its group requires them.

Returns

Promise<OTPStatus>

The answer's data.

Errors

401auth.session_expired: session expired, sign in again

403auth.invalid_terminal: this terminal cannot be used here

403auth.otp_enrol_required: your group requires one-time codes: set them up to continue

403auth.password_change_required: you must change your password first

500internal: something went wrong

SDKcURL

import { staff } from "@/lib/noviqa"

const data = await staff.auth.otp()

bash

curl -X GET "$NOVIQA_API_URL/admin/v1/auth/otp" \
  -H "Authorization: Bearer $NOVIQA_TOKEN"

Response 200

json

{
  "success": true,
  "code": "ok",
  "message": "done",
  "data": {
    "enabled": true,
    "required": true
  },
  "request_id": "5b7f2c1e"
}

staff.auth.otp(options?: RequestOptions): Promise<auth.OTPStatus>

otpConfirm

POST/admin/v1/auth/otp/confirm

Finish one-time code setup (staff)

Turns codes on with the first 6-digit code from the app. A session that had to enrol becomes a full session.

Request body

codestring

Returns

Promise<sessionView>

The answer's data.

Errors

400invalid_input: invalid input

401auth.otp_invalid: wrong one-time code

401auth.otp_not_set: set up one-time codes to continue

401auth.session_expired: session expired, sign in again

403auth.csrf_invalid: request refused: reload the page and try again

403auth.invalid_terminal: this terminal cannot be used here

403auth.otp_enrol_required: your group requires one-time codes: set them up to continue

403auth.password_change_required: you must change your password first

429auth.too_many_attempts: too many attempts, try again later

500internal: something went wrong

SDKcURL

import { staff } from "@/lib/noviqa"

const data = await staff.auth.otpConfirm({
  code: "string"
})

bash

curl -X POST "$NOVIQA_API_URL/admin/v1/auth/otp/confirm" \
  -H "Authorization: Bearer $NOVIQA_TOKEN" \
  -H "Content-Type: application/json" \
  --data-raw '{
  "code": "string"
}'

Response 200

json

{
  "success": true,
  "code": "ok",
  "message": "done",
  "data": {
    "csrf_token": "string",
    "expires_at": "2026-09-25T10:15:00Z",
    "group": "real\\standard",
    "group_scope": [
      "string"
    ],
    "keep_signed_in": true,
    "login": 1001,
    "must_change_password": true,
    "must_enrol_otp": true,
    "read_only": true,
    "rights": [
      "string"
    ],
    "server_clock": {
      "daylight_saving": "none",
      "utc_offset_min": 1
    },
    "terminal": "web"
  },
  "request_id": "5b7f2c1e"
}

staff.auth.otpConfirm(body: http.otpRequest, options?: RequestOptions): Promise<http.sessionView>

otpDisable

POST/admin/v1/auth/otp/disable

Turn one-time codes off (staff)

Needs a current code. Refused when the group requires codes.

Request body

codestring

Returns

Promise<OTPStatus>

The answer's data.

Errors

400invalid_input: invalid input

401auth.otp_invalid: wrong one-time code

401auth.session_expired: session expired, sign in again

403auth.csrf_invalid: request refused: reload the page and try again

403auth.invalid_terminal: this terminal cannot be used here

403auth.otp_enrol_required: your group requires one-time codes: set them up to continue

403auth.password_change_required: you must change your password first

403forbidden: you do not have access to this action

429auth.too_many_attempts: too many attempts, try again later

500internal: something went wrong

SDKcURL

import { staff } from "@/lib/noviqa"

const data = await staff.auth.otpDisable({
  code: "string"
})

bash

curl -X POST "$NOVIQA_API_URL/admin/v1/auth/otp/disable" \
  -H "Authorization: Bearer $NOVIQA_TOKEN" \
  -H "Content-Type: application/json" \
  --data-raw '{
  "code": "string"
}'

Response 200

json

{
  "success": true,
  "code": "ok",
  "message": "done",
  "data": {
    "enabled": true,
    "required": true
  },
  "request_id": "5b7f2c1e"
}

staff.auth.otpDisable(body: http.otpRequest, options?: RequestOptions): Promise<auth.OTPStatus>

otpEnrol

POST/admin/v1/auth/otp/enrol

Start one-time code setup (staff)

Makes a new secret: show uri as a QR code (or secret to type in) in an authenticator app, then confirm with its first code.

Returns

Promise<OTPEnrolment>

The answer's data.

Errors

401auth.session_expired: session expired, sign in again

403auth.csrf_invalid: request refused: reload the page and try again

403auth.invalid_terminal: this terminal cannot be used here

403auth.otp_enrol_required: your group requires one-time codes: set them up to continue

403auth.password_change_required: you must change your password first

409conflict: already exists

500internal: something went wrong

SDKcURL

import { staff } from "@/lib/noviqa"

const data = await staff.auth.otpEnrol()

bash

curl -X POST "$NOVIQA_API_URL/admin/v1/auth/otp/enrol" \
  -H "Authorization: Bearer $NOVIQA_TOKEN"

Response 200

json

{
  "success": true,
  "code": "ok",
  "message": "done",
  "data": {
    "secret": "string",
    "uri": "string"
  },
  "request_id": "5b7f2c1e"
}

staff.auth.otpEnrol(options?: RequestOptions): Promise<auth.OTPEnrolment>

refresh

POST/admin/v1/auth/refresh

Renew the session (staff)

Trades the refresh token for new tokens (the old refresh token stops working). Browsers send nothing in the body: the refresh cookie rides along and X-CSRF-Token is required; other terminals send refresh_token. Call it shortly before access_expires_at, or when a call answers auth.session_expired. Reusing an old refresh token closes the session (auth.refresh_reused).

Request body

refresh_tokenstring

Returns

Promise<tokensView>

The answer's data.

Errors

400invalid_input: invalid input

401auth.refresh_reused: session closed for safety, sign in again

401auth.session_expired: session expired, sign in again

403auth.csrf_invalid: request refused: reload the page and try again

403auth.invalid_terminal: this terminal cannot be used here

409auth.account_changed: the signed-in account changed; sign in again before continuing

500internal: something went wrong

SDKcURL

import { staff } from "@/lib/noviqa"

const data = await staff.auth.refresh({
  refresh_token: "string"
})

bash

curl -X POST "$NOVIQA_API_URL/admin/v1/auth/refresh" \
  -H "Authorization: Bearer $NOVIQA_TOKEN" \
  -H "Content-Type: application/json" \
  --data-raw '{
  "refresh_token": "string"
}'

Response 200

json

{
  "success": true,
  "code": "ok",
  "message": "done",
  "data": {
    "access_expires_at": "2026-09-25T10:15:00Z",
    "access_token": "string",
    "csrf_token": "string",
    "refresh_token": "string",
    "session": {
      "csrf_token": "string",
      "expires_at": "2026-09-25T10:15:00Z",
      "group": "real\\standard",
      "group_scope": [
        "string"
      ],
      "keep_signed_in": true,
      "login": 1001,
      "must_change_password": true,
      "must_enrol_otp": true,
      "read_only": true,
      "rights": [
        "string"
      ],
      "server_clock": {
        "daylight_saving": "none",
        "utc_offset_min": 1
      },
      "terminal": "web"
    },
    "session_expires_at": "2026-09-25T10:15:00Z"
  },
  "request_id": "5b7f2c1e"
}

staff.auth.refresh(body: http.refreshRequest, options?: RequestOptions): Promise<http.tokensView>

staff.auth ​

changePassword ​

login ​

logout ​

me ​

otp ​

otpConfirm ​

otpDisable ​

otpEnrol ​

refresh ​

staff.auth

changePassword

login

logout

me

otp

otpConfirm

otpDisable

otpEnrol

refresh