Sign In

curl --request POST \
  --url https://api.example.com/api/sign-in/ \
  --header 'Content-Type: application/json' \
  --data '
{
  "email": "<string>",
  "password": "<string>"
}
'

import requests

url = "https://api.example.com/api/sign-in/"

payload = {
    "email": "<string>",
    "password": "<string>"
}
headers = {"Content-Type": "application/json"}

response = requests.post(url, json=payload, headers=headers)

print(response.text)

const options = {
  method: 'POST',
  headers: {'Content-Type': 'application/json'},
  body: JSON.stringify({email: '<string>', password: '<string>'})
};

fetch('https://api.example.com/api/sign-in/', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://api.example.com/api/sign-in/",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "POST",
  CURLOPT_POSTFIELDS => json_encode([
    'email' => '<string>',
    'password' => '<string>'
  ]),
  CURLOPT_HTTPHEADER => [
    "Content-Type: application/json"
  ],
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

package main

import (
	"fmt"
	"strings"
	"net/http"
	"io"
)

func main() {

	url := "https://api.example.com/api/sign-in/"

	payload := strings.NewReader("{\n  \"email\": \"<string>\",\n  \"password\": \"<string>\"\n}")

	req, _ := http.NewRequest("POST", url, payload)

	req.Header.Add("Content-Type", "application/json")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

HttpResponse<String> response = Unirest.post("https://api.example.com/api/sign-in/")
  .header("Content-Type", "application/json")
  .body("{\n  \"email\": \"<string>\",\n  \"password\": \"<string>\"\n}")
  .asString();

require 'uri'
require 'net/http'

url = URI("https://api.example.com/api/sign-in/")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Post.new(url)
request["Content-Type"] = 'application/json'
request.body = "{\n  \"email\": \"<string>\",\n  \"password\": \"<string>\"\n}"

response = http.request(request)
puts response.read_body

{
  "access": "<string>",
  "refresh": "<string>",
  "user": {
    "user.id": 123,
    "user.username": "<string>",
    "user.email": "<string>",
    "user.first_name": "<string>",
    "user.last_name": "<string>",
    "user.number_phone": "<string>",
    "user.avatar": "<string>"
  }
}

POST

api

sign-in

curl --request POST \
  --url https://api.example.com/api/sign-in/ \
  --header 'Content-Type: application/json' \
  --data '
{
  "email": "<string>",
  "password": "<string>"
}
'

import requests

url = "https://api.example.com/api/sign-in/"

payload = {
    "email": "<string>",
    "password": "<string>"
}
headers = {"Content-Type": "application/json"}

response = requests.post(url, json=payload, headers=headers)

print(response.text)

const options = {
  method: 'POST',
  headers: {'Content-Type': 'application/json'},
  body: JSON.stringify({email: '<string>', password: '<string>'})
};

fetch('https://api.example.com/api/sign-in/', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://api.example.com/api/sign-in/",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "POST",
  CURLOPT_POSTFIELDS => json_encode([
    'email' => '<string>',
    'password' => '<string>'
  ]),
  CURLOPT_HTTPHEADER => [
    "Content-Type: application/json"
  ],
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

package main

import (
	"fmt"
	"strings"
	"net/http"
	"io"
)

func main() {

	url := "https://api.example.com/api/sign-in/"

	payload := strings.NewReader("{\n  \"email\": \"<string>\",\n  \"password\": \"<string>\"\n}")

	req, _ := http.NewRequest("POST", url, payload)

	req.Header.Add("Content-Type", "application/json")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

HttpResponse<String> response = Unirest.post("https://api.example.com/api/sign-in/")
  .header("Content-Type", "application/json")
  .body("{\n  \"email\": \"<string>\",\n  \"password\": \"<string>\"\n}")
  .asString();

require 'uri'
require 'net/http'

url = URI("https://api.example.com/api/sign-in/")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Post.new(url)
request["Content-Type"] = 'application/json'
request.body = "{\n  \"email\": \"<string>\",\n  \"password\": \"<string>\"\n}"

response = http.request(request)
puts response.read_body

{
  "access": "<string>",
  "refresh": "<string>",
  "user": {
    "user.id": 123,
    "user.username": "<string>",
    "user.email": "<string>",
    "user.first_name": "<string>",
    "user.last_name": "<string>",
    "user.number_phone": "<string>",
    "user.avatar": "<string>"
  }
}

Overview

The sign-in endpoint authenticates existing users and returns JWT access and refresh tokens. Users can authenticate using their email and password.

Endpoint

POST /api/sign-in/

Request Body

string

required

User’s email address registered in the system.

string

required

User’s password.

Response

string

JWT access token for authenticating subsequent API requests. This is a short-lived token.

string

JWT refresh token used to obtain new access tokens when they expire.

object

Complete user object containing authenticated user’s information.

integer

Unique identifier for the user.

string

User’s username.

string

User’s email address.

string

User’s first name.

string

User’s last name.

string

User’s phone number.

string

URL to user’s avatar image (if uploaded).

Example Request

cURL

curl -X POST http://localhost:8000/api/sign-in/ \
  -H "Content-Type: application/json" \
  -d '{
    "email": "[email protected]",
    "password": "SecurePass123!"
  }'

Python

import requests

url = "http://localhost:8000/api/sign-in/"
payload = {
    "email": "[email protected]",
    "password": "SecurePass123!"
}

response = requests.post(url, json=payload)
data = response.json()

# Store tokens for future requests
access_token = data['access']
refresh_token = data['refresh']

JavaScript

fetch('http://localhost:8000/api/sign-in/', {
  method: 'POST',
  headers: {
    'Content-Type': 'application/json',
  },
  body: JSON.stringify({
    email: '[email protected]',
    password: 'SecurePass123!'
  })
})
.then(response => response.json())
.then(data => {
  // Store tokens in localStorage or secure storage
  localStorage.setItem('access_token', data.access);
  localStorage.setItem('refresh_token', data.refresh);
});

Example Response

200 OK

{
  "refresh": "eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9...",
  "access": "eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9...",
  "user": {
    "id": 1,
    "username": "johndoe",
    "email": "[email protected]",
    "first_name": "John",
    "last_name": "Doe",
    "number_phone": "5551234567",
    "avatar": "/media/avatars/profile.jpg"
  }
}

Error Responses

400 Bad Request - Invalid Password

{
  "error": "Invalid password"
}

400 Bad Request - Missing Fields

{
  "error": "Email and password are required."
}

404 Not Found - User Does Not Exist

{
  "error": "User does not exist."
}

500 Internal Server Error

{
  "error": "Error message details"
}

Implementation Details

The sign-in endpoint is implemented in apps/users/views.py:21-44. Here’s the authentication flow:

User Lookup: Retrieves user by email using get_object_or_404()
Password Verification: Validates password using Django’s check_password() method
Token Generation: Creates JWT tokens using RefreshToken.for_user(user)
User Serialization: Returns complete user data via UsersSerializer
Response: Returns tokens and user object on success

Code Reference

From apps/users/views.py:21-44:

@api_view(['POST'])
@permission_classes([AllowAny])
def sign_in(request):
    try:
        user = get_object_or_404(Users, email=request.data.get('email'))

        if not user.check_password(request.data.get('password')):
            return Response({'error': 'Invalid password'}, status=status.HTTP_400_BAD_REQUEST)

        refresh = RefreshToken.for_user(user)
        serializer = UsersSerializer(instance=user)

        return Response({
            'refresh': str(refresh),
            'access': str(refresh.access_token),
            'user': serializer.data
        }, status=status.HTTP_200_OK)

    except KeyError:
        return Response({'error': 'Email and password are required.'}, status=status.HTTP_400_BAD_REQUEST)
    except Users.DoesNotExist:
        return Response({'error': 'User does not exist.'}, status=status.HTTP_404_NOT_FOUND)
    except Exception as e:
        return Response({'error': str(e)}, status=status.HTTP_500_INTERNAL_SERVER_ERROR)

Using the Access Token

Once you receive the access token, include it in the Authorization header for authenticated requests:

cURL

curl -X GET http://localhost:8000/api/profile/ \
  -H "Authorization: Bearer eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9..."

Python

import requests

headers = {
    "Authorization": f"Bearer {access_token}"
}

response = requests.get("http://localhost:8000/api/profile/", headers=headers)

Notes

This endpoint does not require authentication (@permission_classes([AllowAny]))
Authentication is performed using email (not username)
Passwords are never returned in the response
The access token has a limited lifetime and should be refreshed using the refresh token
Failed login attempts return specific error messages to help identify the issue

⌘I

Authentication

Password Generation

Saved Passwords

User Management

Overview

Endpoint

Request Body

Response

Example Request

Example Response

Error Responses

Implementation Details

Code Reference

Using the Access Token

Notes

​Overview

​Endpoint

​Request Body

​Response

​Example Request

​Example Response

​Error Responses

​Implementation Details

​Code Reference

​Using the Access Token

​Notes

Overview

Endpoint

Request Body

Response

Example Request

Example Response

Error Responses

Implementation Details

Code Reference

Using the Access Token

Notes