POST/api/auth/login

Logs in a user and issues a session JWT plus a refresh token. This is the only way to obtain a valid dashboard access token — there is no separate developer API key system.

Auth & Security

No authentication required

Progressive brute-force throttling per email/username (authGuard) -- 10 failed attempts within 5 minutes result in increasing delays; from 30 onward, a lockout is applied.

Idempotent: No

Parameters

identifier(body, string, required)— Email address or username
password(body, string, required)— Password

Example Request

{"identifier":"user@example.com","password":"YourPassword"}

Example Response

{"ok":true,"token":"<JWT, valid for 12h>","refreshToken":"<refresh token, valid for 7 days, single-use>","user":{"id":"...","tenant_id":"...","email":"user@example.com","role":"EMPLOYEE","roles":[],"permissions":[],"isMasterAdmin":false}}

Error Codes

401 INVALID_CREDENTIALS — Email/username or password is incorrect.
429 RATE_LIMIT_EXCEEDED — Too many failed attempts for this identifier or this IP.

Live Test Proof

Success (200, real JWT + refresh token) and negative case (401 on wrong password) verified live against an isolated test stack.

← Authentication