Skip to main content
Authenticate an existing account using an email and password. A successful response includes a short-lived access token and a longer-lived refresh token you can use to obtain new access tokens without re-entering credentials.

​
Request

POST /auth/login
​
string
required
The email address of the account.
​
string
required
The account password.
​
string
Override the session role for this login. Accepted values: USER, RIDER, DRIVER, ADMIN. Falls back to the role stored on the account if omitted or unrecognized.

​
Response

​
string
A signed JWT to include in the Authorization: Bearer <token> header of subsequent requests.
​
string
A token you can exchange for a new access token via Refresh Token.
​
string
Always "Bearer".
​
number
Number of seconds until the access token expires.
​
string
The display name of the authenticated user.
​
string
The effective role for this session.
​
number
The numeric ID of the authenticated user.

​
Example

Store the refreshToken securely (for example, in an HttpOnly cookie or secure storage). You need it to obtain a new access token once the current one expires. Never expose it in client-side JavaScript or logs.

​
Error codes