Skip to main content

​
Authentication

Fortro Engine authenticates clients with DID-bound signatures and returns a JWT for subsequent API calls.

​
Flow

POST /api/auth/login accepts the same did, challenge, and signature body and also returns user plus token.

​
Required Headers

Use the issued JWT for protected routes:
Issuer and verifier calls usually also include the active DID as a path parameter:

​
Auth Endpoints

Client applications still protect seed material locally with their own PIN and recovery flows. The backend auth contract is the DID challenge signature plus JWT.