Skip to main content

Documentation Index

Fetch the complete documentation index at: https://mintlify.com/15aozzz/Lab-Nova-Salud/llms.txt

Use this file to discover all available pages before exploring further.

Botica Nova Salud uses JSON Web Tokens (JWT) for authentication. You log in with a username and password, receive a token, and then include that token in every subsequent API request. Tokens are valid for 8 hours, after which you must log in again.

​
Logging in

Send a POST request to /api/auth/login with your credentials in the request body: 
curl -X POST http://localhost:3000/api/auth/login \
  -H "Content-Type: application/json" \
  -d '{"username": "admin", "password": "admin123"}'

​
Request body

{
  "username": "admin",
  "password": "admin123"
}

​
Successful response

{
  "token": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...",
  "usuario": {
    "id": 1,
    "nombre": "Ana García",
    "cargo": "Administrador"
  }
}
Store the token value — you will include it in all subsequent requests.

​
Making authenticated requests

Add the token to the Authorization header of every request to a protected endpoint: 
Authorization: Bearer <token>

curl http://localhost:3000/api/dashboard/resumen \
  -H "Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9..."

​
Protected routes

All routes except / (the login page) require authentication. A request to a protected route without a valid token returns a 401 response immediately, before any business logic runs.

​
Token expiry

Tokens expire 8 hours after they are issued. Once a token expires, requests return 401 Token inválido. The user must log in again to obtain a new token.
Do not expose your JWT token in client-side source code, public repositories, or browser console logs. Treat it like a password: store it only in memory or localStorage and clear it on logout.

​
Error responses

StatusError messageMeaning
401Usuario no encontradoNo account exists with the given username.
401Contraseña incorrectaThe username exists but the password does not match.
401Token requeridoThe Authorization header is missing from the request.
401Token inválidoThe token is malformed, has been tampered with, or has expired.

​
Test credentials

The database seed data includes two accounts you can use immediately after setup:
UsernamePasswordRole
adminadmin123Administrador
cajero1admin123Cajero
Change these passwords before deploying to any environment accessible outside your local machine.

Build docs developers (and LLMs) love

Get started for freeTalk to us