Authenticates a user with email and password, and returns a JWT token along with the user profile.
Rate Limiting: 10 requests per minute per IP address.
On successful authentication, the response includes a token field containing a signed JWT.
Token payload:
_id — User’s unique identifieremail — User’s email addresscustomerId — Stripe customer ID (if applicable)accountType — One of super, admin, or usersessionId — Server-side session identifieriat — Issued-at timestamp (set automatically by JWT)exp — Expiration timestamp (set automatically by JWT)Token expiration: 6 hours (21,600 seconds) by default. Configurable via JWT_VALIDITY_SEC environment variable.
Include the JWT in every subsequent API request using one of these methods (in priority order):
x-access-token header (recommended):
x-access-token: eyJhbGciOiJIUzI1NiIs...
Authorization header with Bearer scheme:
Authorization: Bearer eyJhbGciOiJIUzI1NiIs...
Query parameter:
GET /api/resource?token=eyJhbGciOiJIUzI1NiIs...
Request body field:
{ "token": "eyJhbGciOiJIUzI1NiIs..." }
When a token is missing, expired, or invalid, the API returns:
Authentication Required)jwt expired) or token invalid (invalid signature)Tokens are automatically refreshed via a sliding session mechanism. Each time the client calls
POST /api/user/refresh/profile, the response includes a fresh JWT token with a new expiration.
This extends the session without requiring re-authentication, as long as the current token is still valid.
The frontend calls this endpoint on every page load, so active users never experience token expiration. If the token expires (e.g., user is inactive for more than 6 hours), a new sign-in is required.
Successful authentication. Returns JWT token and user profile.
Signed JWT token. Include this in subsequent API requests via the x-access-token header or Authorization Bearer header. Expires after 6 hours (configurable via JWT_VALIDITY_SEC). Automatically refreshed on profile load (sliding session).
"eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJfaWQiOiI2NDMwNzM2ZmQ2MmQ2NTAwNDA0MjA2NzQiLCJlbWFpbCI6ImpvaG4uZG9lQG15ZG9tYWluLmNvbSIsImN1c3RvbWVySWQiOiJjdXNfTnh4eHh4eCIsImFjY291bnRUeXBlIjoidXNlciIsInNlc3Npb25JZCI6InMlM0FhYmMxMjMiLCJpYXQiOjE3MDAwMDAwMDAsImV4cCI6MTcwMDA4NjQwMH0.signature"