Skip to main content

Documentation Index

Fetch the complete documentation index at: https://mintlify.com/JuanSCaicedo/Api-Ecommerce/llms.txt

Use this file to discover all available pages before exploring further.

API Ecommerce uses two distinct login endpoints — one for admins and one for customers — to enforce strict role separation at authentication time. Both endpoints accept an email and password, authenticate against the users table filtered by type_user, and return a signed JWT bearer token along with basic user details. All auth routes are rate-limited to 10 requests per minute.

​
Admin Login

POST /api/auth/login
Authenticates users with type_user = 1 (administrators). If the credentials are valid but the account is not an admin, a 401 Unauthorized is returned.

​
Request Body

​
email
string
required
The admin account’s email address.
​
password
string
required
The admin account’s password.

​
Example Request

curl --request POST \
  --url https://your-domain.com/api/auth/login \
  --header 'Content-Type: application/json' \
  --data '{
    "email": "admin@example.com",
    "password": "adminPassword123"
  }'

​
Customer Login

POST /api/auth/login_ecommerce
Authenticates users with type_user = 2 (customers). In addition to valid credentials, the customer’s email must be verified (email_verified_at must not be null). Unverified accounts receive a 401 Unauthorized response.

​
Request Body

​
email
string
required
The customer account’s email address.
​
password
string
required
The customer account’s password.

​
Example Request

curl --request POST \
  --url https://your-domain.com/api/auth/login_ecommerce \
  --header 'Content-Type: application/json' \
  --data '{
    "email": "jane.doe@example.com",
    "password": "securePass123"
  }'

​
Token Response

Both login endpoints return identical token payloads on success.
​
access_token
string
The signed JWT bearer token to include in subsequent authenticated requests via the Authorization: Bearer <token> header.
​
token_type
string
Always "bearer".
​
expires_in
integer
Token lifetime in seconds, calculated as TTL * 60 from the JWT configuration.
​
user.full_name
string
The authenticated user’s full name (name + surname concatenated).
​
user.email
string
The authenticated user’s email address.
​
user.name
string
The authenticated user’s first name.

​
Example Token Response

{
  "access_token": "eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJpc3MiOi...",
  "token_type": "bearer",
  "expires_in": 3600,
  "user": {
    "full_name": "Jane Doe",
    "email": "jane.doe@example.com",
    "name": "Jane"
  }
}
Token logging is active. Every successful login stores the issued JWT alongside the request’s IP address and User-Agent string in the user_tokens table, together with its expiry timestamp. This enables per-device session tracking and targeted revocation.

​
Token Refresh

POST /api/auth/refresh
Exchanges a still-valid (non-expired) Bearer token for a freshly signed one. The response shape is identical to the login token response. Authentication: Requires a valid Authorization: Bearer <token> header. 
curl --request POST \
  --url https://your-domain.com/api/auth/refresh \
  --header 'Authorization: Bearer <your_token>'

​
Logout (Current Session)

POST /api/auth/logout
Invalidates the current Bearer token via auth('api')->logout() and permanently removes its record from the user_tokens table. After this call the token is no longer accepted. Authentication: Requires a valid Authorization: Bearer <token> header. 
curl --request POST \
  --url https://your-domain.com/api/auth/logout \
  --header 'Authorization: Bearer <your_token>'

​
Response

{
  "message": "Successfully logged out"
}

​
Logout Specific Device

POST /api/auth/logout_device
Revokes a specific session token without affecting the caller’s own active session. Useful for invalidating sessions on devices the user no longer has access to. Returns 404 if the token is not found in user_tokens. Authentication: Requires a valid Authorization: Bearer <your_current_token> header.

​
Request Body

​
token
string
required
The JWT token string of the session to revoke.
curl --request POST \
  --url https://your-domain.com/api/auth/logout_device \
  --header 'Authorization: Bearer <your_current_token>' \
  --header 'Content-Type: application/json' \
  --data '{
    "token": "<token_to_revoke>"
  }'

​
Response

{
  "message": "Successfully logged token out"
}

Build docs developers (and LLMs) love

Get started for freeTalk to us