Login

​

Endpoint

​

Request Body

​

Response

​

Success Response

​

Error Responses

​

Authentication Flow

1. The API receives email and password credentials
2. Queries the database for the user by email
3. Compares the provided password with the stored bcrypt hash
4. If valid, generates a JWT token with 1-hour expiration
5. Returns the token for use in authenticated requests

​

Code Examples

curl -X POST http://localhost:8080/login \
  -H "Content-Type: application/json" \
  -d '{
    "email": "[email protected]",
    "password": "yourpassword"
  }'

​

Response Examples

​

Successful Login

{
  "msg": "Autenticación correcta",
  "token": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJ1c2VySWQiOiJ1c2VyQGV4YW1wbGUuY29tIiwibm9tYnJlIjoiJDJiJDEwJC4uLiIsImlhdCI6MTcwOTY0NzIwMCwiZXhwIjoxNzA5NjUwODAwfQ.signature"
}

​

Failed Login - Invalid Password

{
  "msg": "No existe usuario"
}

​

Failed Login - User Not Found

{
  "msg": "Autenticación incorrecta"
}

​

Token Usage

• Token expiration: 1 hour from issuance
• Header format: Authorization: <token>
• Secured endpoints are prefixed with /secured in the API
• Invalid or expired tokens will return a 401 status with message “Token_invalido”
• Missing authorization header will return 401 with message “Sin autorización”

​

Security Notes

• Passwords are verified using bcrypt hashing
• JWT tokens are signed with a secret key stored in environment variables
• Tokens include user email and expire after 1 hour
• Always use HTTPS in production to protect credentials in transit