Authenticating Customers

Authenticate your marketplace customers to access Techrar subscription features without passwords or OTP.

Overview

Customers in your marketplace are already authenticated in your app. To access Techrar's checkout and subscription management endpoints, you need to obtain Techrar access tokens for your authenticated users. This is done through a passwordless authentication flow.

Customers don't need separate Techrar accounts or passwords. We authenticate them based on their identity in your system.

How Authentication Works

User is Authenticated in Your App

Customer logs into your marketplace using your existing authentication system.

Request Techrar Tokens

When customer accesses subscription features, call Techrar's authentication endpoint with customer details from your system.

This step is required for checkout & subscription management. But you can display offerings such as providers, tags, plans, and menus wihtout the need to authenticate the customer as those are using your API keys.

Receive Access & Refresh Tokens

Techrar returns JWT tokens that you'll use for all customer-specific API calls (checkout, subscriptions, locations).

Store Tokens Securely

Save the tokens in your app (secure storage/keychain) and use them for subsequent API calls.

Authenticate Customer

Endpoint

Request Body

{
  "username": "0534501057",
  "name": "Ahmed Ali",
  "email": "[email protected]",
  "source": "jahez",
  "engine": "direct"
}

Parameters

Parameter	Type	Required	Description
`username`	string	Yes	Customer's unique identifier (phone, user ID, etc.)
`name`	string	Yes	Customer's full name
`email`	string	Yes	Customer's email address
`source`	string	Yes	Your marketplace name (e.g., "jahez", "nana", "thechefz")
`engine`	string	Yes	Use `"direct"` for passwordless auth

Important

username must be unique per customer in your system

Use consistent source value across all requests (your marketplace identifier)

Always use engine: "direct" for sales channel authentication

Response

{
  "access": "eyJ0eXAiOiJKV1QiLCJhbGc...",
  "refresh": "eyJ0eXAiOiJKV1QiLCJhbGc..."
}

Tokens:

access: Short-lived token for API requests (use in Authorization header)

refresh: Long-lived token to obtain new access tokens when expired

Using Tokens

Access Token

Use the access token for all customer-specific API calls:

Refresh Token

When access token expires (typically 30 days), use Refresh Access Token to get a new one.

Best Practices

Token Management

Store tokens in secure storage (keychain/encrypted storage)

Never expose tokens in logs or UI

Clear tokens on user logout

Implement automatic token refresh before expiration

Error Handling

Handle 401 errors by refreshing tokens

Re-authenticate if refresh token is invalid

Show appropriate error messages to users

Security

Use HTTPS for all API calls

Validate customer data before authentication

Implement rate limiting on your end

Monitor for suspicious authentication patterns

User Experience

Authenticate silently in the background

Cache tokens for quick access

Pre-authenticate before showing subscription features

Handle offline scenarios gracefully

Common Scenarios

New Customer

First time accessing subscriptions:

Customer browses your app (already logged in)

Customer clicks on subscription feature

Authenticate customer → store tokens

Proceed with subscription flow

Returning Customer

Customer with stored tokens:

Check if access token exists

Use token for API calls

Refresh if expired

Continue subscription management

Customer Logs Out

When customer logs out of your app:

Clear Techrar tokens from storage

Clear any cached subscription data

Re-authenticate on next login

Troubleshooting

401 Unauthorized

Cause: Token expired or invalid

Solution: Refresh access token using refresh token, or re-authenticate

400 Bad Request

Cause: Missing or invalid authentication parameters

Solution: Verify all required fields (username, name, email, source, engine) are provided

Duplicate User Issues

Cause: Same username used with different email/name

Solution: Ensure consistent customer data across authentication calls

Authenticating Customers

Overview#

How Authentication Works#

Authenticate Customer#

Endpoint#

Request Body#

Parameters#

Response#

Using Tokens#

Access Token#

Refresh Token#

Best Practices#

Token Management#

Error Handling#

Security#

User Experience#

Common Scenarios#

New Customer#

Returning Customer#

Customer Logs Out#

Troubleshooting#

401 Unauthorized#

400 Bad Request#

Duplicate User Issues#

Overview

How Authentication Works

Authenticate Customer

Endpoint

Request Body

Parameters

Response

Using Tokens

Access Token

Refresh Token

Best Practices

Token Management

Error Handling

Security

User Experience

Common Scenarios

New Customer

Returning Customer

Customer Logs Out

Troubleshooting

401 Unauthorized

400 Bad Request

Duplicate User Issues