# API (Key Endpoints)

Base path: `/api`

## Auth

- `POST /login`
- `POST /send-otp`
  - Sends OTP to phone (OTP is **not** returned in response)
- `POST /verify-otp`
- `POST /logout` (auth required)

## Webhooks

- `POST /webhooks/razorpay`
  - Public endpoint (as required by Razorpay)
  - **Authenticated via signature verification** (`X-Razorpay-Signature`)

