POST /api/login
Authenticates a user with email and password credentials. Returns an access token and sets secure HTTP-only cookies for both access and refresh tokens.Request Body
string
required
User’s email address (will be normalized)Validation: Must be a valid email format
string
required
User’s password
Response
string
Success message
string
JWT access token for API authentication
Cookies Set
The endpoint sets two HTTP-only cookies:cookie
Expiry: 8-9 daysDevelopment:
- httpOnly: true
- secure: false
- sameSite: Lax
- expires: 9 days
- httpOnly: true
- secure: true
- sameSite: Strict
- domain: .deployhub.cloud
- expires: 8 days
cookie
Expiry: 6-10 hoursDevelopment:
- httpOnly: true
- secure: false
- sameSite: Lax
- expires: 10 hours
- httpOnly: true
- secure: true
- sameSite: Strict
- domain: .deployhub.cloud
- expires: 6 hours
Status Codes
200- Login successful400- Validation error, account doesn’t exist, or invalid password500- Internal server error
Example Request
Example Response
Error Responses
Token Details
Access Token JWT Payload:Notes
- Passwords are compared using bcrypt hashing
- The refresh token is stored in the database for validation
- Access tokens should be included in the
Authorizationheader for authenticated requests - Email addresses are normalized before lookup (lowercase, trimmed)