The login flow in AirGuide is a two-step process. This page covers step one: verifying credentials and triggering an OTP email. Use POST /api/auth/verify-2fa to exchange that code for a JWT. If a valid code was not received, useDocumentation Index
Fetch the complete documentation index at: https://mintlify.com/luiss811/Backend-Airguide/llms.txt
Use this file to discover all available pages before exploring further.
POST /api/auth/resend-otp (documented below) to request a fresh one.
POST /api/auth/login
Validates email and password. If the account is active and credentials are correct, generates a one-time code and sends it to the user’s email address.Request body
The user’s registered email address.
The user’s password in plain text. Transmitted over HTTPS; never logged or stored in plain form.
Response — 200 OK
Always
true when credentials are accepted. Indicates the client must complete the OTP step.The email address to which the OTP was sent. Echo this value when calling
/verify-2fa.Human-readable confirmation:
"Código de verificación enviado a tu correo electrónico."Error responses
| Status | Body | Cause |
|---|---|---|
401 | { "error": "Credenciales incorrectas" } | Email not found or password mismatch. |
403 | { "error": "Tu cuenta aún no ha sido validada. Por favor contacta al administrador." } | Account estado is pendiente or rechazado. |
400 | { "error": "<validation message>" } | Zod schema validation failed (e.g. missing field). |
Example
POST /api/auth/resend-otp
Invalidates any unused OTP for the account and sends a fresh code to the same email. Call this when the user did not receive the original code or when the code has expired.Request body
The email address of the account for which a new OTP is requested.
Response — 200 OK
A confirmation string. Returns
"Si el correo existe, recibirás un nuevo código." when the email is not found or the account is not active, and "Nuevo código enviado a tu correo electrónico." when the code was sent.This endpoint always returns HTTP 200 regardless of whether the email exists in the system. This prevents email enumeration — you cannot use the response to determine whether an account is registered.