Skip to main content

Documentation Index

Fetch the complete documentation index at: https://mintlify.com/fredy-rizo/Ecommerce/llms.txt

Use this file to discover all available pages before exploring further.

The login endpoint validates a user’s credentials and returns a signed JSON Web Token (JWT) that grants access to all protected endpoints. The token is valid for 365 days from the time of issue and must be included in the token-access header on every authenticated request. No authentication token is required to call this endpoint itself.
The account must be verified and active before login is permitted. If you have not yet verified your account, call POST /api/user/verify-account with the 5-digit code sent to your email at registration.

​
Endpoint

Method: POST
Path: /api/user/login
Auth required: No

​
Prerequisites

The user account must have an activation status of { name: "Activado", value: "1" } and a confirmed login_code_confirmed value. Accounts that have not completed email verification will be rejected with a 403 response. Complete the account verification flow first if needed.

​
Request Body

​
email
string
required
The email address used when registering the account.
​
password
string
required
The account password. Compared against the stored bcrypt hash.

​
Response — 200 OK

A successful login returns a JWT and the full user profile. Store the token securely — it is required for all protected endpoints.
​
msj
string
Always "Bienvenido!" on success.
​
status
boolean
Always true on success.
​
token
string
A signed JWT string, valid for 365 days. Pass this value in the token-access header on all subsequent authenticated requests.
​
user
object
The authenticated user’s profile data, embedded in the JWT payload and returned in the response body.

​
Example Request

curl -X POST https://your-api-domain.com/api/user/login \
  -H "Content-Type: application/json" \
  -d '{
    "email": "carlos.reyes@example.com",
    "password": "SecurePass123!"
  }'

​
Example Response

{
  "msj": "Bienvenido!",
  "status": true,
  "token": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6IjY0YWJjMTIzIiwidXNlck5hbWUiOiJDYXJsb3MgUmV5ZXMiLCJlbWFpbCI6ImNhcmxvcy5yZXllc0BleGFtcGxlLmNvbSIsInJvbGVzIjpbeyJuYW1lIjoiVXN1YXJpbyIsInZhbHVlIjoiMSJ9XSwiaWF0IjoxNjkwMDAwMDAwLCJleHAiOjE3MjE1MzYwMDB9.signature",
  "user": {
    "id": "64abc123",
    "userName": "Carlos Reyes",
    "email": "carlos.reyes@example.com",
    "phone": "3001234567",
    "sex": "Masculino",
    "document": "1023456789",
    "documentType": "CC",
    "birthdate": "1992-08-15",
    "roles": [{ "name": "Usuario", "value": "1" }],
    "activate": [{ "name": "Activado", "value": "1" }]
  }
}

​
Using the Token in Subsequent Requests

Once you have the token, include it in the token-access header for every protected endpoint call: 
curl -X POST https://your-api-domain.com/api/user/update/64abc123/user \
  -H "Content-Type: application/json" \
  -H "token-access: eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9..." \
  -d '{
    "firstName": "Carlos",
    "lastName": "Reyes",
    "phone": "3009876543",
    "sex": "Masculino"
  }'
Store the JWT in a secure location such as an HttpOnly cookie or a secure in-memory store. Avoid storing it in localStorage in browser environments to reduce XSS exposure.

​
Error Responses

Status CodeMeaning
203Wrong password, or one or more required fields are missing from the request.
403The account exists but is not yet activated. Verify the account before attempting to log in.
500An unexpected server error occurred.

Build docs developers (and LLMs) love

Get started for freeTalk to us