Skip to main content
POST
/
api
/
auth
/
login
curl -X POST https://your-instance.replit.app/api/auth/login \
  -H "Content-Type: application/json" \
  -d '{
    "email": "[email protected]",
    "password": "your-secure-password"
  }' \
  -c cookies.txt

{
  "message": "Login successful",
  "user": {
    "id": "550e8400-e29b-41d4-a716-446655440000",
    "email": "[email protected]",
    "organizationId": "660e8400-e29b-41d4-a716-446655440000",
    "role": "admin",
    "firstName": "John",
    "lastName": "Doe"
  }
}

​
Overview

Authenticates a user with email and password. On success, sets an HTTP-only session cookie that must be included in all subsequent requests.

​
Request Body

​
email
string
required
User’s email address
​
password
string
required
User’s password (minimum 8 characters)

​
Response

​
message
string
Success message
​
user
object
User object containing:
curl -X POST https://your-instance.replit.app/api/auth/login \
  -H "Content-Type: application/json" \
  -d '{
    "email": "[email protected]",
    "password": "your-secure-password"
  }' \
  -c cookies.txt

{
  "message": "Login successful",
  "user": {
    "id": "550e8400-e29b-41d4-a716-446655440000",
    "email": "[email protected]",
    "organizationId": "660e8400-e29b-41d4-a716-446655440000",
    "role": "admin",
    "firstName": "John",
    "lastName": "Doe"
  }
}

​
Notes

The session cookie (sessionId) is automatically set in the response headers. It expires after 7 days of inactivity.
Login attempts are rate-limited to 10 per minute per IP address to prevent brute force attacks.
The response includes a Set-Cookie header: 
Set-Cookie: sessionId=abc123...; Path=/; HttpOnly; Secure; SameSite=Strict; Max-Age=604800
Cookie Properties:
  • HttpOnly: Cannot be accessed by JavaScript (security)
  • Secure: Only sent over HTTPS
  • SameSite=Strict: CSRF protection
  • Max-Age: 7 days (604800 seconds)

​
Using the Session

Include the session cookie in all subsequent requests: 
// Fetch automatically includes cookies when credentials: 'include'
fetch('https://your-instance.replit.app/api/customers', {
  credentials: 'include'
});

​
Next Steps

After logging in:
  1. Get user info: GET /api/auth/me
  2. Fetch data: Use any authenticated endpoint
  3. Logout: POST /api/auth/logout when done

View All Auth Endpoints

Explore register, logout, password reset, and more