Auth

The V1 auth endpoints are how partner integrations exchange an email + password for a Sanctum personal-access token. They are the only V1 routes that do not require an Authorization header.

• Log in
  • Body parameters
  • Responses
• Register

Log in#

POST /api/v1/login

Validates the credentials against Laravel's auth guard. On success it issues a Sanctum personal-access token via auth()->user()->createToken('authToken')->plainTextToken and returns the user record alongside the plaintext token.

Body parameters#

Validated inline in App\Http\Controllers\Api\V1\AuthController::login() (not via a Form Request):

Responses#

• 200 — { "user": { ... }, "access_token": "..." }. Send Authorization: Bearer {access_token} on subsequent V1 requests.
• 200 — { "message": "Invalid Credentials" } when auth()->attempt() fails. The V1 controller returns this body via response([...]), which defaults to a 200 status — clients must check the body, not just the HTTP status, to detect invalid credentials.
• 422 Unprocessable Entity — standard Laravel validation error envelope when email or password is missing or malformed.

Register#

POST /api/v1/register

AuthController::register() short-circuits via response()->json(403) and returns a body of literal 403 with HTTP status 200. The endpoint is wired for parity but registration must be performed inside FinDesk's web app.