> ## Documentation Index
> Fetch the complete documentation index at: https://docs.wassly.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Login

## Overview

This endpoint authenticates users and initiates a login session. It validates user credentials (email and password) and returns authentication tokens or session information upon successful authentication.

## Request Details

### Required Fields

* **email** (string, required): The user's registered email address

  * Must be a valid email format

  * Example: `user@example.com`
* **password** (string, required): The user's account password

  * Should meet the application's password requirements

  * Transmitted securely over HTTPS

### Request Headers

* `Content-Type: application/json` - Indicates JSON payload

* `Accept: application/json` - Expects JSON response

* `apikey: xxx` - Can be generated from the admin dashboard

## Expected Response

### Success Response (200 OK)

Returns authentication credentials and user information:

* Authentication token(s) for subsequent API requests

* User profile data

* Session expiration details

### Error Responses

* **400 Bad Request**: Missing or invalid email/password format

* **401 Unauthorized**: Invalid credentials

* **429 Too Many Requests**: Rate limit exceeded

* **500 Internal Server Error**: Server-side error

## Authentication Flow

1. User submits email and password via POST request

2. Server validates credentials against stored user data

3. Upon successful validation:

   * Authentication token is generated

   * Session is created

   * Token and user data are returned

4. Client stores token for authenticated requests

5. Token is included in subsequent API calls (typically in Authorization header)

## Usage Notes & Best Practices

* **Security**: Always use HTTPS in production to protect credentials in transit

* **Token Storage**: Store authentication tokens securely (e.g., httpOnly cookies, secure storage)

* **Error Handling**: Never expose detailed error messages that could aid attackers

* **Password Requirements**: Ensure passwords meet security standards (length, complexity)

* **Session Management**: Implement proper logout functionality to invalidate tokens

## Example Usage

```json theme={null}
POST {{baseUrl}}/api/login
Content-Type: application/json
{
  "email": "user@example.com",
  "password": "securePassword123"
}

```


## OpenAPI

````yaml POST /api/login
openapi: 3.1.0
info:
  title: Wassly API Documentation
  version: 1.0.0
  description: Wassly API Documentation.
servers:
  - url: https://www.wassly.com
security: []
paths:
  /api/login:
    post:
      tags:
        - Authentication
      operationId: Authentication_POST_api_login_post_api_login
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              properties:
                email:
                  type: string
                password:
                  type: string
              required:
                - email
                - password
            example:
              email: hatem.gaballah@gmail.com
              password: abc123$
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                type: object
                properties:
                  success:
                    type: boolean
                  message:
                    type: string
                  data:
                    type: object
                    properties:
                      id:
                        type: integer
                        format: int32
                      name:
                        type: string
                      role_id:
                        type: integer
                        format: int32
                      client_id:
                        type: integer
                        format: int32
                      phone:
                        type: string
                      email:
                        type: string
                      location:
                        type: string
                      profile_image:
                        type: string
                      openai_api_key:
                        type: string
                      token:
                        type: string
                    required:
                      - id
                      - name
                      - role_id
                      - client_id
                      - phone
                      - email
                      - location
                      - profile_image
                      - openai_api_key
                      - token
                required:
                  - success
                  - message
                  - data
              example:
                success: true
                message: Login Successfully
                data:
                  id: 2
                  name: User Name
                  role_id: 3
                  client_id: 1
                  phone: +{mobile_number}
                  email: user@example.com
                  location: ''
                  profile_image: >-
                    https://www.wassly.com/public/images/20251216152039image_163x116_user_436.png
                  openai_api_key: null
                  token: '{token}'
        '401':
          description: Unauthorized
          content:
            application/json:
              schema:
                type: object
                properties:
                  success:
                    type: boolean
                  message:
                    type: string
                  data:
                    type: array
                    items: {}
                required:
                  - success
                  - message
                  - data
              example:
                success: false
                message: Invalid Credentials
                data: []
      security:
        - apiKeyAuth: []
components:
  securitySchemes:
    apiKeyAuth:
      type: apiKey
      in: header
      name: apikey

````