Skip to main content

Documentation Index

Fetch the complete documentation index at: https://mintlify.com/123048152-JJDS/CafeteriaPM_S203/llms.txt

Use this file to discover all available pages before exploring further.

The CafeteriaPM API uses JWT Bearer tokens for authentication. All protected endpoints require an Authorization: Bearer <token> header. Tokens are obtained by posting credentials to POST /auth/login — there is no other authentication flow.

​
POST /auth/login

Validates user credentials and returns a signed JWT token along with basic user information. The token embeds the user’s ID and role, which the API uses for access control on every subsequent request.
Only active users (activo == true) can authenticate. Deactivated accounts receive 401 Unauthorized regardless of whether the password is correct.

​
Request Body

​
email
string
required
The user’s email address. Must match an active user account exactly.
​
password
string
required
The user’s plain-text password. Verified against the bcrypt hash stored in the database.

​
Request Examples

curl -X POST http://localhost:8000/auth/login \
  -H "Content-Type: application/json" \
  -d '{
    "email": "[email protected]",
    "password": "Admin123!"
  }'

​
Response (200 OK)

​
access_token
string
Signed JWT token. Include in all subsequent requests as Authorization: Bearer <access_token>.
​
token_type
string
Always "bearer". Indicates the token scheme expected in the Authorization header.
​
user_id
integer
The authenticated user’s database ID.
​
nombre
string
The authenticated user’s display name.
​
rol
string
The user’s assigned role: admin, mesero, caja, or cocina.
Example response: 
{
  "access_token": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxIiwicm9sIjoiYWRtaW4iLCJleHAiOjE3MDQ4NjcyMDB9.xyz",
  "token_type": "bearer",
  "user_id": 1,
  "nombre": "Administrador",
  "rol": "admin"
}

​
Error Responses

StatusBodyCause
401 Unauthorized{"detail": "Credenciales incorrectas"}Email not found, account is inactive, or password does not match

​
Using the Token

Once you have an access_token, include it as a Bearer token in the Authorization header of every protected request: 
curl http://localhost:8000/productos/ \
  -H "Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9..."
The API validates the token signature, checks expiry, and resolves the active user on every request before executing any protected endpoint handler.

​
Token Details

PropertyValue
AlgorithmHS256 — configurable via the ALGORITHM environment variable
Default expiry480 minutes (8 hours) — configurable via ACCESS_TOKEN_EXPIRE_MINUTES
Signing keyDerived from the SECRET_KEY environment variable
JWT payload claims:
ClaimTypeDescription
substringThe authenticated user’s ID, encoded as a string (e.g. "1")
rolstringThe user’s role name (e.g. "admin", "mesero")
expintegerUnix timestamp at which the token expires
A decoded token payload looks like: 
{
  "sub": "1",
  "rol": "admin",
  "exp": 1704867200
}

​
Token Errors

Protected endpoints share a common set of error responses produced by the get_current_user and require_roles dependency chain in app/core/security.py:
StatusBodyCause
401 Unauthorized{"detail": "Token inválido o expirado"}JWT signature is invalid or the token has expired
401 Unauthorized{"detail": "Token inválido"}JWT decoded successfully but the sub claim is missing
401 Unauthorized{"detail": "Usuario no encontrado o inactivo"}Token is valid but the referenced user account no longer exists or has been deactivated
403 Forbidden{"detail": "Acceso denegado. Rol requerido: admin"}User is authenticated but does not have the role required by the endpoint
All 401 responses from protected endpoints include a WWW-Authenticate: Bearer header, as required by the OAuth2 Bearer Token specification.

​
Interactive API Docs

The Swagger UI at http://localhost:8000/docs includes a built-in Authorize button (🔒) in the top-right corner. Click it, enter Bearer <your_token> in the value field, then click Authorize — all subsequent requests made from the browser will automatically include your token in the Authorization header.

Build docs developers (and LLMs) love

Get started for freeTalk to us