Login

POST /api/auth/login Validates a Cloudflare Turnstile token, checks the user’s credentials, and returns a signed JWT on success.

Request body

string

required

Username of the account to authenticate.

string

required

Plain-text password. Compared against the bcrypt hash stored in the database.

string

required

Cloudflare Turnstile token obtained from the client-side widget. Verified against the Turnstile /siteverify endpoint before any credential check.

Response

boolean

required

true on a successful login.

string

required

Signed JWT. Expires in 8 hours. The payload contains id, idPerfil, and nombre.

object

required

Show properties

number

Primary key of the user record.

string

Username (strNombreUsuario).

number

Profile (role) ID associated with the user.

string

Email address (strCorreo).

string | null

Phone number (strNumeroCelular). null if not set.

string | null

Cloudinary URL of the user’s profile image. null if not uploaded.

Error responses

Status	Message	Cause
`400`	`Fallo en la validación del captcha.`	Turnstile verification returned `success: false`.
`401`	`El usuario no existe o su estado es inactivo.`	No user found with that username, or `idEstadoUsuario` is `false`.
`401`	`Usuario o contraseña incorrectos.`	Password does not match the stored bcrypt hash.

Store the returned token in an auth_token cookie with maxAge set to 8 hours (28800 seconds) to match the JWT expiry.

Examples

curl --request POST \
  --url https://your-domain.com/api/auth/login \
  --header 'Content-Type: application/json' \
  --data '{
    "strNombreUsuario": "admin",
    "strPwd": "secret123",
    "turnstileToken": "<turnstile-response-token>"
  }'

const response = await fetch('/api/auth/login', {
  method: 'POST',
  headers: { 'Content-Type': 'application/json' },
  body: JSON.stringify({
    strNombreUsuario: 'admin',
    strPwd: 'secret123',
    turnstileToken: '<turnstile-response-token>',
  }),
});

const data = await response.json();
// Store the token in a cookie
document.cookie = `auth_token=${data.token}; max-age=28800; path=/`;

Success response

200

{
  "success": true,
  "token": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...",
  "user": {
    "id": 1,
    "nombre": "admin",
    "idPerfil": 1,
    "correo": "admin@example.com",
    "celular": "555-1234",
    "imagenUrl": "https://res.cloudinary.com/demo/image/upload/usuarios_corp/sample.jpg"
  }
}

Authentication

Users

Profiles

Modules

Permissions

Request body

Response

Error responses

Examples

Success response

​Request body

​Response

​Error responses

​Examples

​Success response

Request body

Response

Error responses

Examples

Success response