Overview This endpoint authenticates an employee using their email and password. Upon successful authentication, it returns both an access token and a refresh token via HTTP-only cookies.
Request Body Employee’s registered email address. Must be a valid email format.
Employee’s password. Must be at least 6 characters long.
Response Authentication status. Returns true when login is successful.
Cookies Set On successful login, the following cookies are automatically set:
JWT token for accessing protected endpoints. Short-lived token. Cookie Settings:
httpOnly: falsesecure: truesameSite: none JWT token for refreshing the access token. Long-lived token. Cookie Settings:
httpOnly: falsesecure: truesameSite: none curl -X POST https://api.demet.com/intern/login \ -H "Content-Type: application/json" \ -c cookies.txt \ -d '{ "email": "[email protected] ", "password": "123456" }'
200 Success
401 User Not Found
401 Incorrect Password
400 Validation Error
Authentication Flow
Submit Credentials : Send email and password to the login endpointVerification : System verifies email exists and password matchesToken Generation : Access and refresh tokens are generatedCookie Storage : Tokens are sent as secure HTTP-only cookiesSubsequent Requests : Browser automatically includes cookies in future requests
Validation Rules Show Login Schema Validation
Field Type Validation Error Message email string Valid email format ”Email Invalido” password string Minimum 6 characters ”La contraseña debe tener al menos 6 caracteres”
Security Features
Passwords are compared using bcrypt hashing
Tokens are stored in secure cookies (HTTPS only in production)
Access tokens expire after a short period (use refresh token to renew)
Refresh tokens have a longer expiration time
Failed login attempts return generic error messages to prevent user enumeration
Token Payload The generated tokens contain the following claims:
{ "id_employee" : 123 , "rol" : "Administrador" }
Next Steps After successful login:
Use the access token (automatically included in cookies) to access protected endpoints
When the access token expires, use the refresh endpoint to get a new one
Use the logout endpoint to end the session