POST /auth/login — Authenticate and Obtain a Token

Use this endpoint to exchange your Avalex staff credentials for a signed JWT access token. The token is valid for 7 days and must be included in the Authorization: Bearer header on every authenticated request. No API key or additional setup is required — a valid username and password are all you need to get started.

POST https://api.avalex.com/auth/login

This is a public endpoint. No authentication header is required to call it.

Request Body

string

required

Your staff account username as registered in the Avalex Admin Portal.

string

required

Your account password.

Request Example

curl -X POST https://api.avalex.com/auth/login \
  -H "Content-Type: application/json" \
  -d '{"username": "ada", "password": "a-strong-password"}'

Response — 200 OK

A successful login returns a JWT token alongside a summary of the authenticated user’s identity and permissions.

string

A signed JWT access token. Include this value in the Authorization: Bearer <token> header on all subsequent authenticated requests. Tokens expire after 7 days.

object

Details about the currently authenticated user.

Show user fields

string

The username of the authenticated staff account.

boolean

true if this account is the Master Admin; false for all other roles.

string[]

An array of permission strings granted to this account, such as customers:read or licenses:write. Use these values to determine which API operations your token can perform.

string

The name of the role assigned to this account, for example Support or Admin.

Response Example

{
  "token": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...",
  "user": {
    "username": "ada",
    "isMasterAdmin": false,
    "permissions": ["customers:read", "customers:write"],
    "role": "Support"
  }
}

Error Responses

Status	Body	Description
`401 Unauthorized`	`{"error": "Invalid username or password"}`	The provided credentials did not match any active staff account.

Repeated failed login attempts may indicate a compromised credential. If you believe your account has been accessed without authorization, contact your Master Admin immediately to rotate your password.

Notes

This endpoint is also available as POST /staff/login, which is an aliased route with identical behavior. Both paths accept the same request body and return the same response schema.

Authentication

License Validation

Resources

Staff & Admin

Audit Logs

POST /auth/login — Authenticate and Obtain a Token

Request Body

Request Example

Response — 200 OK

Response Example

Error Responses

Notes

​Request Body

​Request Example

​Response — 200 OK

​Response Example

​Error Responses

​Notes

Request Body

Request Example

Response — 200 OK

Response Example

Error Responses

Notes