POST /v1/auth/login — authenticate and receive a token

Authenticate with email and password. Returns a JWT session token to use in the Authorization header for protected API calls.

Exchange a registered email and password for a signed JWT session token. Attach the returned token to every subsequent authenticated request via the Authorization: Bearer <token> header. Tokens are time-limited — when one expires, prompt the user to log in again to receive a fresh token.

Endpoint

POST /v1/auth/login

Authentication

None required. This is a public endpoint.

Request Body

email · string · required

The email address associated with the Axis account.

password · string · required

The account password.

Request Example

{
  "email": "[e-mail]",
  "password": "sup3rS3cur3!"
}

Response — 200 OK

A successful request returns HTTP 200 with a JSON body containing a JWT session token and the authenticated user record. Note that token lives directly inside data, alongside user — it is not nested inside data.user.

status · string

Always "success" for a successful response.

data · object

Container for the session token and authenticated user details.

Show data fields

data.token · string

A signed JWT session token. Include this in the Authorization: Bearer <token> header for all authenticated requests.

data.user · object

The authenticated user record.

Show user fields

data.user.id · string

Unique UUID for the user account.

data.user.email · string

The email address associated with the account.

data.user.accountType · string

The account type: "developer" or "business".

data.user.businessId · string | null

UUID of the associated business entity when accountType is "business". null for developer accounts.

data.user.createdAt · string

ISO 8601 timestamp of when the account was created.

{
  "status": "success",
  "data": {
    "token": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6ImU5YjFmMjAzLTQ4NzEtNGUwZS1hNmNkLTFkNzZkYmMxNjNmZiIsImVtYWlsIjoiZGV2QGFjbWUuaW8iLCJpYXQiOjE3NTMwODgwMDAsImV4cCI6MTc1MzE3NDQwMH0.dummysignature",
    "user": {
      "id": "e9b1f203-4871-4e0e-a6cd-1d76dbc163ff",
      "email": "[e-mail]",
      "accountType": "developer",
      "businessId": null,
      "createdAt": "2026-07-21T09:00:00.000Z"
    }
  }
}

Error Responses

400 — Validation Error

Returned when a required field is missing or malformed.

{
  "status": "error",
  "errors": [
    {
      "code": "invalid_type",
      "expected": "string",
      "received": "undefined",
      "path": ["password"],
      "message": "Required"
    }
  ]
}

401 — Invalid Credentials

Returned when the email does not exist or the password is incorrect. The response is intentionally generic to avoid leaking whether an email address is registered.

{
  "status": "fail",
  "message": "Invalid email or password"
}