---
title: Registration & OTP
description: Create an account with an email and a six-digit verification code.
---

Registration is two requests: the human reads a short-lived code from their inbox, and the caller receives a session token plus a Superior Trade API key.

> **Base URL:** `https://api.superior.trade` · these two endpoints are unauthenticated. Use the returned `api_key` as `x-api-key` for Unified API requests.

### POST /account/register

Sends a six-digit code to start registration or re-authentication.

```bash
curl -X POST https://api.superior.trade/account/register \
  -H "content-type: application/json" \
  -d '{"email":"operator@example.com"}'
```

**Response — `200`**

```json
{ "status": "otp_sent", "expires_in": 600 }
```

The code expires after 10 minutes. Only the most recently sent code is valid; it is stored as a hash and allows five verification attempts.
Each email address can request up to three codes in six hours.

### POST /account/verify

Verifies the code and returns a session token plus an API key.

```bash
curl -X POST https://api.superior.trade/account/verify \
  -H "content-type: application/json" \
  -d '{"email":"operator@example.com","otp":"482913"}'
```

**Response — `200`**

```json
{
  "token": "…",
  "user": { "id": "…", "email": "operator@example.com" },
  "api_key": "st_live_4f2a9c81d7e3b0e6…"
}
```

`token` authenticates account-management requests. `api_key` authenticates Unified API requests and appears once in this response.

### Verify from your terminal

Use the tabs to select the HTTP client you use to submit the operator's OTP.

```bash
curl -X POST https://api.superior.trade/account/verify \
  -H "content-type: application/json" \
  -d '{"email":"operator@example.com","otp":"482913"}'
```

```bash
curl https://api.superior.trade/account \
  -H "x-api-key: st_live_4f2a9c81d7e3b0e6…"
```