Login

Authenticates a user and returns access/refresh tokens for API authorization. Supports optional 2FA verification.

Endpoint

POST/v2/auth/login

Link

Gateway APIstagep.tst-apidmndelss.com

Request

Headers

Key	Value	Required
Content-Type	application/json	Yes
Accept	application/json	Yes

Request Body (JSON)

Field	Type	Description	Required	Example
login	string	Email	Yes	"[email protected]"
password	string	Password	Yes	"SecurePass123!"
code	string	2FA code (if enabled).	No	"123456"

Credentials are provided by our team when you start testing (test version, stage) and finish testing (production environment).

Example Request Body:

json

{
  "login": "[email protected]",
  "password": "SecurePass123!",
  "code": "123456"
}

---

Response (200 OK)

Returns authentication tokens and their expiration times.

Response Fields

Field	Type	Description	Example
accessToken	string	JWT token for API authorization. Valid for accessTtl seconds.	"eyJhbGci...xyz"
refreshToken	string	Long-lived token to renew accessToken when expired.	"eyJhbGci...abc"
UserId	string	Unique user identifier.	"5ff73da8-224e-44de-a235-2d7a76c3144c"
accessTtl	integer	Access token lifetime (seconds).	3600 (1 hour)
refreshTtl	integer	Refresh token lifetime (seconds).	2592000 (30 days)

Example Response:

{
  "accessToken": "eyJhbGci...xyz",
  "refreshToken": "eyJhbGci...abc",
  "guid": "usr_5f3d8e2a",
  "accessTtl": 3600,
  "refreshTtl": 2592000
}

Error Cases

1. Invalid Credentials:

   { "error": "Invalid login or password" }

2. Missing 2FA Code:

   { "error": "2FA code required", "requires2fa": true }

3. Expired/Invalid 2FA Code:

   { "error": "Invalid or expired 2FA code" }

4. Account Locked:

   { "error": "Account locked after 5 failed attempts" }

---

Notes

• Token Usage:

  • Include accessToken in the Authorization: Bearer <token> header for authenticated requests.
  • Use refreshToken to call /v2/auth/refresh when accessToken expires.
• Security:

  • Passwords are case-sensitive.
  • refreshToken should be stored securely (e.g., HTTP-only cookie).
• 2FA:

  • The code field is optional unless 2FA is enabled for the account.
  • If 2FA is required but not provided, the response will include "requires2fa": true.

Examples

Real request

{
  "login": "[email protected]",
  "password": "testpassword",
  "code": "<string>"
}

Real response

{
  "accessToken": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOjE2NCwiZXhwIjoxNzYzNTQ5NTU1LCJrZXkiOiI1Y2ZiOGZjN2RmYjk4ZjVkYmIyZTgwNTVkZWFhN2U2Zjk4MzEyYmE3Iiwib3RwX3ZlcmlmaWVkIjpmYWxzZX0.OHY4Gtx1S9W-eOjcLUHqPd5gDB4aqVDec7q9to0L9-0",
  "refreshToken": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOjE2NCwiZXhwIjoxNzYzNTUwMTU1LCJrZXkiOiI1Y2ZiOGZjN2RmYjk4ZjVkYmIyZTgwNTVkZWFhN2U2Zjk4MzEyYmE3Iiwib3RwX3ZlcmlmaWVkIjpmYWxzZX0.7n7GBsWhqaLkBU3-exTTau2E1RmGuoUBB7rz-vXtm90",
  "userId": "5ff73da8-224e-44de-a235-2d7a76c3144c",
  "accessTtl": 299,
  "refreshTtl": 899
}