Skip to main content

Documentation Index

Fetch the complete documentation index at: https://mintlify.com/CKoldo/Vacaciones-front/llms.txt

Use this file to discover all available pages before exploring further.

The Vacaciones API uses JSON Web Tokens (JWT) for authentication. Every protected endpoint requires a valid token in the Authorization header. The only endpoint that does not require a token is POST /api/auth/login.

​
Obtaining a token

Exchange a username and password for a JWT by calling the login endpoint.

​
POST /api/auth/login

​
username
string
required
The account username.
​
password
string
required
The account password.
Response
​
token
string
required
A signed JWT. Include this value in the Authorization header of subsequent requests.
curl -X POST http://localhost:5175/api/auth/login \
  -H "Content-Type: application/json" \
  -d '{"username": "admin", "password": "secret"}'

​
Token payload

The JWT payload contains the following claims:
ClaimTypeDescription
idstringThe user’s unique identifier
usernamestringThe user’s login name
role"admin" | "user"The user’s role
You can decode the payload client-side with standard base64 decoding. The front end reads the payload to populate the authenticated user context: 
function parseJwt(token: string) {
  const payload = token.split('.')[1];
  const decoded = atob(payload.replace(/-/g, '+').replace(/_/g, '/'));
  return JSON.parse(decodeURIComponent(escape(decoded)));
  // returns { id, username, role }
}

​
Using the token

Include the token as a Bearer credential in the Authorization header on every protected request: 
curl http://localhost:5175/api/personal \
  -H "Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9..."
The front end stores the token in localStorage under the key token and attaches it automatically to every apiFetch call.

​
Token expiry and logout

When the user logs out, the front end removes the token from localStorage. The server does not provide a token revocation endpoint; tokens remain valid until they expire according to their embedded exp claim.

​
401 Unauthorized

If a request is made with a missing or invalid token, the server responds with 401 Unauthorized.
All endpoints except POST /api/auth/login return 401 when the Authorization header is absent or the token is expired or malformed. Obtain a fresh token via the login endpoint and retry.

Build docs developers (and LLMs) love

Get started for freeTalk to us