Authenticates a user with email and password, and returns a JWT token along with the user profile.
Rate Limiting: 10 requests per minute per IP address.
On successful authentication, the response includes a token field containing a signed JWT.
Token payload:
_id — User’s unique identifieremail — User’s email addresscustomerId — Stripe customer ID (if applicable)accountType — One of super, admin, or usersessionId — Server-side session identifieriat — Issued-at timestamp (set automatically by JWT)exp — Expiration timestamp (set automatically by JWT)Token expiration: 24 hours (86,400 seconds) by default.
Include the JWT in every subsequent API request using one of these methods (in priority order):
x-access-token header (recommended):
x-access-token: eyJhbGciOiJIUzI1NiIs...
Authorization header with Bearer scheme:
Authorization: Bearer eyJhbGciOiJIUzI1NiIs...
Query parameter:
GET /api/resource?token=eyJhbGciOiJIUzI1NiIs...
Request body field:
{ "token": "eyJhbGciOiJIUzI1NiIs..." }
When a token is missing, expired, or invalid, the API returns:
Authentication Required)jwt expired) or token invalid (invalid signature)Tokens are not automatically refreshed. To obtain a new token, call this endpoint again with valid credentials before the current token expires.
Successful authentication. Returns JWT token and user profile.
Signed JWT token. Include this in subsequent API requests via the x-access-token header or Authorization Bearer header. Expires after 24 hours.
"eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJfaWQiOiI2NDMwNzM2ZmQ2MmQ2NTAwNDA0MjA2NzQiLCJlbWFpbCI6ImpvaG4uZG9lQG15ZG9tYWluLmNvbSIsImN1c3RvbWVySWQiOiJjdXNfTnh4eHh4eCIsImFjY291bnRUeXBlIjoidXNlciIsInNlc3Npb25JZCI6InMlM0FhYmMxMjMiLCJpYXQiOjE3MDAwMDAwMDAsImV4cCI6MTcwMDA4NjQwMH0.signature"