Generate JWT token (for API access)

POST

/api/auth/token

Request Body^required

Login credentials

object

mfa_code

string | null

password

required

string

remember_me

boolean | null

return_url

Optional post-login destination. Validated server-side against the safe-redirect rules in utils::url_validation; bad values are dropped rather than returned to the client.

string | null

username

required

string

{
  "mfa_code": "123456",
  "password": "SecurePass123!",
  "remember_me": true,
  "username": "user@example.com"
}

Responses

200

JWT access/refresh token pair issued

object

access_token

required

string

expires_in

required

integer format: int64

refresh_token

string | null

token_type

required

string

401

Invalid credentials

403

Email not verified