Skip to main content

POST /api/login

Authenticates a user with email and password credentials. Returns an access token and sets secure HTTP-only cookies for both access and refresh tokens.

Request Body

string
required
User’s email address (will be normalized)Validation: Must be a valid email format
string
required
User’s password

Response

string
Success message
string
JWT access token for API authentication

Cookies Set

The endpoint sets two HTTP-only cookies:
cookie
Expiry: 8-9 daysDevelopment:
  • httpOnly: true
  • secure: false
  • sameSite: Lax
  • expires: 9 days
Production:
  • httpOnly: true
  • secure: true
  • sameSite: Strict
  • domain: .deployhub.cloud
  • expires: 8 days
cookie
Expiry: 6-10 hoursDevelopment:
  • httpOnly: true
  • secure: false
  • sameSite: Lax
  • expires: 10 hours
Production:
  • httpOnly: true
  • secure: true
  • sameSite: Strict
  • domain: .deployhub.cloud
  • expires: 6 hours

Status Codes

  • 200 - Login successful
  • 400 - Validation error, account doesn’t exist, or invalid password
  • 500 - Internal server error

Example Request

Example Response

Error Responses

Token Details

Access Token JWT Payload:
Refresh Token JWT Payload:

Notes

  • Passwords are compared using bcrypt hashing
  • The refresh token is stored in the database for validation
  • Access tokens should be included in the Authorization header for authenticated requests
  • Email addresses are normalized before lookup (lowercase, trimmed)