Skip to main content
POST
/
api
/
login
Login
curl --request POST \
  --url https://api.example.com/api/login \
  --header 'Content-Type: application/json' \
  --data '
{
  "username": "<string>",
  "password": "<string>"
}
'
{
  "message": "<string>",
  "token": "<string>",
  "user": {
    "id": 123,
    "username": "<string>",
    "email": "<string>",
    "name": "<string>"
  }
}

​
Request Body

​
username
string
required
The username of the account to authenticate.
​
password
string
required
The password for the account. Will be compared against the stored bcrypt hash.

​
Response

​
message
string
Success message indicating login was successful.
​
token
string
JWT token for authentication. Valid for 72 hours. Include this in the Authorization header as Bearer <token> for protected endpoints.
​
user
object
The authenticated user’s information.
​
id
integer
The user’s unique ID.
​
username
string
The user’s username.
​
email
string
The user’s email address.
​
name
string
The user’s display name.
The JWT token contains claims for userID, username, and expiration time (exp). Tokens are signed using HS256 with the server’s JWT_SECRET.

​
Error Responses

Returned when request validation fails or required fields are missing.
{
  "error": "Key: 'loginRequest.Username' Error:Field validation for 'Username' failed on the 'required' tag"
}
Returned when the username doesn’t exist or the password is incorrect.
{
  "error": "Invalid username or password"
}
For security reasons, the same error message is returned for both non-existent users and incorrect passwords.
Returned when JWT token generation fails.
{
  "error": "Failed to generate token"
}

​
Example Request

curl -X POST https://api.defdrive.com/api/login \
  -H "Content-Type: application/json" \
  -d '{
    "username": "johndoe",
    "password": "securePassword123"
  }'

​
Example Response

200 Success
{
  "message": "Login successful",
  "token": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJleHAiOjE3MTA3NTQ4MDAsInVzZXJJRCI6MSwidXNlcm5hbWUiOiJqb2huZG9lIn0.XYZ123...",
  "user": {
    "id": 1,
    "username": "johndoe",
    "email": "[email protected]",
    "name": "John Doe"
  }
}

​
Using the Token

After successful login, include the JWT token in the Authorization header for all protected endpoints: 
curl -X GET https://api.defdrive.com/api/user/limits \
  -H "Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9..."
Tokens expire after 72 hours. The client should handle 401 responses and prompt the user to log in again.

Build docs developers (and LLMs) love

Get started for freeTalk to us