POST/auth/login

Authenticate a user

Exchange email + password for an access token (JWT) and refresh token. Send the access token as a Bearer header on all protected requests.

🌐 PublicTry in Console →

Purpose

Call this before any authenticated request. The returned accessToken is a JWT you must include as `Authorization: Bearer <token>` on every protected endpoint. accessTokens are short-lived; use refreshToken to obtain a new one without re-entering credentials.

Authentication

This endpoint is public — no authentication required.

Parameters

Name	In	Type	Description
email*	body	string	Login email
password*	body	string	Account password

Request samples

bash

curl -X POST https://tourapi.nirajp.com.np/api/v1/auth/login \
  -H "Content-Type: application/json" \
  -d '{"email":"owner@org.com","password":"Secret123!"}'

Success response

Returns 200 OK with the shape below.

Field	Type	Description
accessToken	string	JWT — send as Bearer header on protected calls
refreshToken	string	Long-lived token to mint a new accessToken
user.id	number	User id
user.email	string	Login email
user.role	string	owner \| operator \| agent \| admin

json

{
  "success": true,
  "message": "Login successful.",
  "data": {
    "accessToken": "eyJhbGciOi...",
    "refreshToken": "def50200...",
    "user": {
      "id": 12,
      "email": "owner@org.com",
      "role": "owner"
    }
  }
}

Errors

All errors share the envelope { "success": false, "message": "..." }.

400A required field is missing or malformed (e.g. invalid email, short password).

json

{
  "success": false,
  "message": "Validation failed",
  "errors": {
    "email": "email must be a valid email"
  }
}

401Wrong email/password or the account is not yet approved (still "pending").

json

{
  "success": false,
  "message": "Invalid credentials"
}

500An unexpected error occurred on our side. Retry; if it persists, contact support.

json

{
  "success": false,
  "message": "Internal server error"
}

← All endpoints Open in Console →