Log in and obtain a JWT

POST

https://platform.verolabs.co

api

auth

curl --request POST \
  --url https://platform.verolabs.co/api/auth/login \
  --header 'Content-Type: application/json' \
  --data '
{
  "identifier": "<string>",
  "password": "<string>"
}
'

const options = {
  method: 'POST',
  headers: {'Content-Type': 'application/json'},
  body: JSON.stringify({identifier: '<string>', password: '<string>'})
};

fetch('https://platform.verolabs.co/api/auth/login', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

import requests

url = "https://platform.verolabs.co/api/auth/login"

payload = {
    "identifier": "<string>",
    "password": "<string>"
}
headers = {"Content-Type": "application/json"}

response = requests.post(url, json=payload, headers=headers)

print(response.text)

package main

import (
	"fmt"
	"strings"
	"net/http"
	"io"
)

func main() {

	url := "https://platform.verolabs.co/api/auth/login"

	payload := strings.NewReader("{\n  \"identifier\": \"<string>\",\n  \"password\": \"<string>\"\n}")

	req, _ := http.NewRequest("POST", url, payload)

	req.Header.Add("Content-Type", "application/json")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

using RestSharp;


var options = new RestClientOptions("https://platform.verolabs.co/api/auth/login");
var client = new RestClient(options);
var request = new RestRequest("");
request.AddJsonBody("{\n  \"identifier\": \"<string>\",\n  \"password\": \"<string>\"\n}", false);
var response = await client.PostAsync(request);

Console.WriteLine("{0}", response.Content);

CURL *hnd = curl_easy_init();

curl_easy_setopt(hnd, CURLOPT_CUSTOMREQUEST, "POST");
curl_easy_setopt(hnd, CURLOPT_WRITEDATA, stdout);
curl_easy_setopt(hnd, CURLOPT_URL, "https://platform.verolabs.co/api/auth/login");

struct curl_slist *headers = NULL;
headers = curl_slist_append(headers, "Content-Type: application/json");
curl_easy_setopt(hnd, CURLOPT_HTTPHEADER, headers);

curl_easy_setopt(hnd, CURLOPT_POSTFIELDS, "{\n  \"identifier\": \"<string>\",\n  \"password\": \"<string>\"\n}");

CURLcode ret = curl_easy_perform(hnd);

{
  "status": "authenticated",
  "sessionToken": "<session-token>",
  "jwt": "<jwt>",
  "session": {
    "active": true,
    "authenticator_assurance_level": "aal1",
    "tokenized": "<jwt>"
  },
  "identity": null,
  "tokenizedSession": {
    "active": true,
    "authenticator_assurance_level": "aal1",
    "tokenized": "<jwt>"
  }
}

Send authentication requests to https://platform.verolabs.co. Use the resulting JWT for protected REST API requests to https://api-oms.verolabs.co.

Response states

Both states below use HTTP 200. Check status before reading jwt.

`status`	Meaning	Next action
`authenticated`	All required authentication factors passed. The response contains `jwt` and `sessionToken`.	Send `jwt` as `Authorization: Bearer <jwt>` to the REST API.
`mfa_required`	A second factor is required. The response contains `methods` and `expiresAt`, without `jwt` or `sessionToken`.	Preserve the response cookie and verify a second factor.

When two-factor authentication is enabled, password verification alone does not issue a JWT. For example, a pending challenge can return:

{
  "status": "mfa_required",
  "methods": ["totp", "lookup_secret"],
  "expiresAt": "2026-10-20T12:00:00Z"
}

methods lists the available methods for this challenge. totp accepts the current six-digit authenticator code. lookup_secret accepts an unused saved backup code. Select a method returned by the API.

Log in with cURL

These Bash examples require curl and jq. Keep the same cookie jar through login and verification. Browser requests must originate from the authentication host; cross-origin requests are rejected.

1. Submit the email and password

AUTH_BASE_URL="https://platform.verolabs.co"
COOKIE_JAR="$(mktemp)"
chmod 600 "$COOKIE_JAR"
read -r -p "Account email: " IDENTIFIER
read -r -s -p "Password: " PASSWORD
printf '\n'

AUTH_RESPONSE="$(curl --silent --show-error --fail-with-body \
  --request POST "$AUTH_BASE_URL/api/auth/login" \
  --cookie-jar "$COOKIE_JAR" \
  --header 'Content-Type: application/json' \
  --data "$(jq -n --arg identifier "$IDENTIFIER" --arg password "$PASSWORD" \
    '{identifier: $identifier, password: $password}')")"
unset PASSWORD

printf '%s\n' "$AUTH_RESPONSE" | jq '{status, methods, expiresAt}'

If status is authenticated, proceed to step 3. If it is mfa_required, complete step 2 before extracting the JWT.

2. Verify the second factor when required

For totp, read the current six-digit code from your authenticator app. Keep it as a string to preserve leading zeros.

MFA_METHOD="totp"
read -r -s -p "Authenticator code: " MFA_CODE
printf '\n'

AUTH_RESPONSE="$(curl --silent --show-error --fail-with-body \
  --request POST "$AUTH_BASE_URL/api/auth/mfa/verify" \
  --cookie "$COOKIE_JAR" \
  --cookie-jar "$COOKIE_JAR" \
  --header 'Content-Type: application/json' \
  --data "$(jq -n --arg method "$MFA_METHOD" --arg code "$MFA_CODE" \
    '{method: $method, code: $code}')")"
unset MFA_CODE

printf '%s\n' "$AUTH_RESPONSE" | jq '{status, aal: .session.authenticator_assurance_level}'

To use a backup code, set MFA_METHOD="lookup_secret" and enter an unused saved backup code instead. Use this option only when lookup_secret is listed in methods. Successful verification consumes that backup code. The successful response has status: "authenticated", a JWT, and authenticator_assurance_level: "aal2" in its session objects. The API clears the pending challenge cookie.

3. Call the REST API with the JWT

JWT="$(printf '%s\n' "$AUTH_RESPONSE" \
  | jq -er 'select(.status == "authenticated") | .jwt')"

curl --silent --show-error --fail-with-body \
  --header "Authorization: Bearer $JWT" \
  'https://api-oms.verolabs.co/api/v1/oms/risk/accounts'

rm -- "$COOKIE_JAR"
unset AUTH_RESPONSE JWT

sessionToken and jwt serve different purposes. Use jwt for REST API authorization. Keep sessionToken confidential; it can be used to resume an existing session.

Retry and expiration

An incorrect code returns an error; no JWT is issued. You can retry verification while the challenge remains valid. If the API returns HTTP 410, restart login to obtain a new challenge and cookie. Do not reuse a consumed backup code or construct a challenge cookie yourself.

Body

application/json

Email identifier and password credentials.

Password login request. Set identifier to the account email address.

identifier

string

required

Email address associated with the Vero OMS account.

Minimum string length: 1

password

string

required

Current password for the Vero OMS account.

Minimum string length: 1

Response

Authenticated session and JWT, or a pending second-factor challenge. Inspect status.

Option 1
Option 2

Check status on every successful HTTP response. authenticated includes the JWT; mfa_required requires POST /api/auth/mfa/verify with the response cookie.

status

enum<string>

required

Indicates that authentication is complete and the JWT can be used.

Available options:

authenticated

sessionToken

string

required

Account session token. Keep it confidential. Use it for session resumption; use jwt for REST API authorization.

jwt

string

required

Bearer JWT for protected REST API requests. Send it as Authorization: Bearer .

session

object

required

Active authenticated session.

Hide child attributes

session.id

string

Unique identifier for the record.

session.active

boolean

Indicates whether the session is active.

session.authenticated_at

string<date-time>

Timestamp when the session was authenticated.

session.expires_at

string<date-time>

Timestamp when the session expires.

session.devices

object[]

Devices associated with the authenticated session.

Hide child attributes

session.devices.ip_address

string

IP address reported for the session device.

session.devices.location

string

Location metadata reported for the session device.

session.devices.user_agent

string

User agent reported for the session device.

session.identity

object | null

Account identity returned with the authenticated session, or null if no identity is returned.

Hide child attributes

session.identity.id

string

Unique identifier for the record.

session.identity.traits

object

Account attributes returned with the authenticated session.

session.tokenized

string

Bearer JWT issued for REST API calls.

session.authenticator_assurance_level

enum<string>

Authentication assurance level: aal1 after first-factor authentication; aal2 after successful two-factor authentication.

Available options:

aal1,

aal2

identity

object | null

required

Account identity, or null if absent.

Hide child attributes

identity.id

string

Unique identifier for the record.

identity.traits

object

Account attributes returned with the authenticated session.

tokenizedSession

object

required

Authenticated session containing the JWT in tokenized.

Hide child attributes

tokenizedSession.id

string

Unique identifier for the record.

tokenizedSession.active

boolean

Indicates whether the session is active.

tokenizedSession.authenticated_at

string<date-time>

Timestamp when the session was authenticated.

tokenizedSession.expires_at

string<date-time>

Timestamp when the session expires.

tokenizedSession.devices

object[]

Devices associated with the authenticated session.

Hide child attributes

tokenizedSession.devices.ip_address

string

IP address reported for the session device.

tokenizedSession.devices.location

string

Location metadata reported for the session device.

tokenizedSession.devices.user_agent

string

User agent reported for the session device.

tokenizedSession.identity

object | null

Account identity returned with the authenticated session, or null if no identity is returned.

Hide child attributes

tokenizedSession.identity.id

string

Unique identifier for the record.

tokenizedSession.identity.traits

object

Account attributes returned with the authenticated session.

tokenizedSession.tokenized

string

Bearer JWT issued for REST API calls.

tokenizedSession.authenticator_assurance_level

enum<string>

Authentication assurance level: aal1 after first-factor authentication; aal2 after successful two-factor authentication.

Available options:

aal1,

aal2

curl --request POST \
  --url https://platform.verolabs.co/api/auth/login \
  --header 'Content-Type: application/json' \
  --data '
{
  "identifier": "<string>",
  "password": "<string>"
}
'

const options = {
  method: 'POST',
  headers: {'Content-Type': 'application/json'},
  body: JSON.stringify({identifier: '<string>', password: '<string>'})
};

fetch('https://platform.verolabs.co/api/auth/login', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

import requests

url = "https://platform.verolabs.co/api/auth/login"

payload = {
    "identifier": "<string>",
    "password": "<string>"
}
headers = {"Content-Type": "application/json"}

response = requests.post(url, json=payload, headers=headers)

print(response.text)

package main

import (
	"fmt"
	"strings"
	"net/http"
	"io"
)

func main() {

	url := "https://platform.verolabs.co/api/auth/login"

	payload := strings.NewReader("{\n  \"identifier\": \"<string>\",\n  \"password\": \"<string>\"\n}")

	req, _ := http.NewRequest("POST", url, payload)

	req.Header.Add("Content-Type", "application/json")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

using RestSharp;


var options = new RestClientOptions("https://platform.verolabs.co/api/auth/login");
var client = new RestClient(options);
var request = new RestRequest("");
request.AddJsonBody("{\n  \"identifier\": \"<string>\",\n  \"password\": \"<string>\"\n}", false);
var response = await client.PostAsync(request);

Console.WriteLine("{0}", response.Content);

CURL *hnd = curl_easy_init();

curl_easy_setopt(hnd, CURLOPT_CUSTOMREQUEST, "POST");
curl_easy_setopt(hnd, CURLOPT_WRITEDATA, stdout);
curl_easy_setopt(hnd, CURLOPT_URL, "https://platform.verolabs.co/api/auth/login");

struct curl_slist *headers = NULL;
headers = curl_slist_append(headers, "Content-Type: application/json");
curl_easy_setopt(hnd, CURLOPT_HTTPHEADER, headers);

curl_easy_setopt(hnd, CURLOPT_POSTFIELDS, "{\n  \"identifier\": \"<string>\",\n  \"password\": \"<string>\"\n}");

CURLcode ret = curl_easy_perform(hnd);

{
  "status": "authenticated",
  "sessionToken": "<session-token>",
  "jwt": "<jwt>",
  "session": {
    "active": true,
    "authenticator_assurance_level": "aal1",
    "tokenized": "<jwt>"
  },
  "identity": null,
  "tokenizedSession": {
    "active": true,
    "authenticator_assurance_level": "aal1",
    "tokenized": "<jwt>"
  }
}

Overview

Integrations

Authentication

REST API

Streaming API

FIX API

Response states

Log in with cURL

1. Submit the email and password

2. Verify the second factor when required

3. Call the REST API with the JWT

Retry and expiration

Body

Response

​Response states

​Log in with cURL

​1. Submit the email and password

​2. Verify the second factor when required

​3. Call the REST API with the JWT

​Retry and expiration

Body

Response

Response states

Log in with cURL

1. Submit the email and password

2. Verify the second factor when required

3. Call the REST API with the JWT

Retry and expiration