Skip to main content
Oynk separates users from organizations. A user can hold memberships, while each request operates in one active organization with a role and resolved permission set.

​
Organization types

  • BUSINESS: initiates payments and payouts and manages business operations.
  • SETTLEMENT_PARTNER: supplies liquidity or executes approved settlement legs.
  • INTERNAL: operates Oynk review, risk, support, payment, and technical functions.
Organizations progress through explicit states such as email verification required, compliance incomplete, submitted, under review, approved, active, suspended, or closed. SANDBOX, TEST, and LIVE platform modes keep experimentation separate from production use.

​
Sign-in flow

1

Password verification

The server normalizes email and verifies a scrypt password hash.
2

OTP challenge

A six-digit, expiring, attempt-limited challenge is delivered by the configured email provider.
3

Session creation

The server stores only a keyed hash of the random session token and returns an HTTP-only cookie.
4

Organization selection

The session binds an active organization and returns its role and permissions.
5

CSRF enforcement

State-changing authenticated requests must present the separate CSRF token.
Sensitive values are not logged. Production rejects the development token pepper, development admin key, and development email provider.