Skip to main content

Documentation Index

Fetch the complete documentation index at: https://mintlify.com/123048152-JJDS/CafeteriaPM_S203/llms.txt

Use this file to discover all available pages before exploring further.

CafeteriaPM authenticates all API requests with JSON Web Tokens (JWT). You obtain a token by posting credentials to POST /auth/login. Every subsequent request must carry the token in an Authorization: Bearer <token> header. Tokens are signed with HS256 and expire after 480 minutes (8 hours) by default.

​
Obtaining a Token

Send your email and password as a JSON body to the login endpoint. Both fields are required. 
curl -X POST http://localhost:8000/auth/login \
  -H "Content-Type: application/json" \
  -d '{"email": "[email protected]", "password": "Admin123!"}'
A successful response returns the token alongside basic profile information: 
{
  "access_token": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...",
  "token_type": "bearer",
  "user_id": 1,
  "nombre": "Administrador",
  "rol": "admin"
}
FieldTypeDescription
access_tokenstringThe signed JWT to include in subsequent requests
token_typestringAlways "bearer" — use as the scheme prefix in the Authorization header
user_idintegerYour numeric user ID in the database
nombrestringYour display name
rolstringYour assigned role (admin, mesero, caja, or cocina)

​
Using the Token

Include the token in the Authorization header of every protected request using the Bearer scheme. 
curl http://localhost:8000/productos/ \
  -H "Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9..."
Here is the equivalent using the Python requests library: 
import requests

token = "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9..."
headers = {"Authorization": f"Bearer {token}"}

response = requests.get("http://localhost:8000/productos/", headers=headers)
print(response.json())

​
Token Payload

The JWT payload contains three standard claims used by the API:
ClaimValueDescription
subUser ID as a stringUsed to look up the User record on each request
rolRole name stringUsed by require_roles to authorize endpoint access
expUnix timestampControls when the token expires
On every request, the API decodes the token with python-jose using the SECRET_KEY and ALGORITHM values from config. The sub claim is resolved to a live database record, so tokens issued to deactivated users are rejected even before expiry.

​
Token Expiry

Tokens expire after ACCESS_TOKEN_EXPIRE_MINUTES minutes (default 480 minutes / 8 hours). There is no refresh token endpoint — simply re-authenticate by calling POST /auth/login again when your token expires. Requests made with an expired token return 401 Unauthorized with {"detail": "Token inválido o expirado"}.

​
Error Responses

The login and authorization layer returns the following error codes. All error bodies follow the shape {"detail": "..."}.
HTTP StatusdetailCause
401"Credenciales incorrectas"Wrong email, wrong password, or the account is inactive
401"Token inválido o expirado"The JWT is expired, malformed, or has an invalid signature
401"Usuario no encontrado o inactivo"Token is valid but the user record has been deactivated
403"Acceso denegado. Rol requerido: ..."Authenticated successfully but the role is not permitted for this endpoint

​
Passwords

Passwords are hashed with bcrypt via passlib before being stored. The plain-text password is only ever transmitted in the body of the POST /auth/login request — always use HTTPS in production. Never store or log plain passwords anywhere in your application code.

Build docs developers (and LLMs) love

Get started for freeTalk to us