Authentication API — POST /api/auth/login

The Authentication API provides a single login endpoint that validates a user’s email and password against hashed credentials stored in the database. On success it returns a signed JSON Web Token (JWT) and the full user profile. Every other protected endpoint in the SS Restaurant API requires this token in the Authorization header.

Authenticate a user and receive a JWT. No prior authentication is required to call this endpoint. POST /api/auth/login

Request body

string

required

The registered email address of the user.

password

string

required

The user’s plain-text password. It is compared against the stored bcrypt hash server-side.

Response fields

token

string

A signed HS256 JWT. Valid for 8 hours from the moment of issue. Pass this value in the Authorization: Bearer <token> header on all protected requests.

user

object

The authenticated user’s profile.

Show user object

number

Unique numeric identifier of the user record.

nombre

string

User’s first name.

apellido

string

User’s last name.

string

The email address used to log in.

rol

string

The user’s role. One of admin, mesero, cajero, or cocina.

activo

boolean

true if the account is active. Inactive accounts are rejected at login.

Audit logging

Every successful login is recorded in the system audit log. The server calls logAudit with the action LOGIN against the usuarios table, capturing the user ID, email, and client IP address. Failed login attempts are not logged.

Error responses

Status	Condition
`400 Bad Request`	`email` or `password` field is missing from the request body.
`401 Unauthorized`	User not found for the given email address.
`401 Unauthorized`	Password does not match the stored hash.
`401 Unauthorized`	User account exists but `activo` is `false`.
`500 Internal Server Error`	Unexpected server-side error.

Example request

curl -X POST https://your-api-host/api/auth/login \
  -H "Content-Type: application/json" \
  -d '{
    "email": "[email protected]",
    "password": "superSecret42"
  }'

Example response

{
  "token": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6MSwiZW1haWwiOiJhZG1pbkBzc3Jlc3RhdXJhbnQuY29tIiwicm9sIjoiYWRtaW4iLCJpYXQiOjE3MTAwMDAwMDAsImV4cCI6MTcxMDAyODgwMH0.abc123signature",
  "user": {
    "id": 1,
    "nombre": "Carlos",
    "apellido": "Mendoza",
    "email": "[email protected]",
    "rol": "admin",
    "activo": true
  }
}

Using the token

Include the token in the Authorization header of every request to a protected endpoint. Tokens expire after 8 hours; your client must re-authenticate after expiry.

curl https://your-api-host/api/orders \
  -H "Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9..."

The JWT payload embeds the user’s id, email, and rol. Role-based middleware on protected routes reads these claims directly — no additional lookup is needed for basic authorization.

Authentication

Restaurant Operations

Billing & Reporting

Administration

Authentication API — POST /api/auth/login

Request body

Response fields

Audit logging

Error responses

Example request

Example response

Using the token

Build docs developers (and LLMs) love

Authentication

Restaurant Operations

Billing & Reporting

Administration

Documentation Index

​POST /api/auth/login

​Request body

​Response fields

​Audit logging

​Error responses

​Example request

​Example response

​Using the token

Build docs developers (and LLMs) love

POST /api/auth/login

Request body

Response fields

Audit logging

Error responses

Example request

Example response

Using the token