Authentication

Sign in with your email and password to receive an access token. Send that token with every other request.

Sign in#

POST /api/auth/login

curl -X POST https://<your-host>/api/auth/login \
  -H "Content-Type: application/json" \
  -d '{"email": "you@example.com", "password": "your-password"}'

A successful sign-in returns 200 with the token and the signed-in user. The response is shown here with the fields shortened.

{
  "message": "Login successful",
  "accessToken": "<token>",
  "user": {
    "id": "…",
    "email": "you@example.com",
    "name": "…",
    "role": "…",
    "roleLabel": "…",
    "department": "…"
  }
}

Use the token#

Send the token in the Authorization header on every other request.

Authorization: Bearer <accessToken>

Browsers do not need to do this. A successful sign-in also sets an HttpOnly auth_token cookie, and the API accepts either one.

Check who you are#

GET /api/auth/me returns the signed-in user. It is a quick way to test that a token still works.

Sign out#

POST /api/auth/logout ends the session. After that, the token is refused with 401.

Failed sign-ins#

Successful sign-ins do not count towards the limit.

Other password endpoints#