Skip to main content

Documentation Index

Fetch the complete documentation index at: https://mintlify.com/ricardomb-tech/auth-service/llms.txt

Use this file to discover all available pages before exploring further.

Submitting a valid email and password returns two tokens: a short-lived JWT access token for authorising API requests, and a long-lived opaque refresh token for obtaining new token pairs without re-entering credentials. Both tokens must be stored securely on the client — the access token in memory and the refresh token in an HttpOnly cookie or secure storage.

​
POST /auth/login

Authentication: None required

​
Request Body

​
email
string
required
The registered email address. Must not be blank.
​
password
string
required
The account password. Must not be blank. Maximum 72 characters. The size cap is a defence-in-depth guard — it does not encode password policy; a password that fails policy is rejected as invalid credentials, not as a 400.

​
Response — 200 OK

​
accessToken
string
A signed HS256 JWT. Include this in the Authorization: Bearer <accessToken> header for every protected request. TTL: 15 minutes (900 seconds).
​
refreshToken
string
An opaque, randomly generated refresh token. Use it with POST /auth/refresh to obtain a new token pair. TTL: 7 days.
​
tokenType
string
Always "Bearer".
​
expiresInSeconds
number
Access token lifetime in seconds. Always 900 (15 minutes).
Example 200 response: 
{
  "accessToken": "eyJhbGciOiJIUzI1NiJ9.eyJzdWIiOiI4ZjQyYmM5MS0...",
  "refreshToken": "dGhpcyBpcyBhbiBvcGFxdWUgcmFuZG9tIHRva2Vu",
  "tokenType": "Bearer",
  "expiresInSeconds": 900
}

​
Error Responses

StatusCondition
401 UnauthorizedEmail not found, password incorrect, or account not in ACTIVE status. The error message is deliberately identical for all three cases (anti-enumeration).
400 Bad RequestA required field is missing or blank. Returns application/problem+json.
Example 401 response: 
{
  "type": "about:blank",
  "title": "Unauthorized",
  "status": 401,
  "detail": "Email o contraseña incorrectos.",
  "instance": "/auth/login"
}

​
curl Example

curl -s -X POST http://localhost:8080/auth/login \
  -H 'Content-Type: application/json' \
  -d '{
    "email": "alice@example.com",
    "password": "s3cur3P@ssword!"
  }'
The account must be in ACTIVE status before login is permitted. Accounts that have registered but not yet completed email verification remain in PENDING_VERIFICATION status and will receive the same generic 401 response as accounts with wrong credentials. Complete email verification via POST /auth/verify first.

Build docs developers (and LLMs) love

Get started for freeTalk to us