Users
Authenticate user
Validates email/password credentials via bcrypt. Returns a JWT access token in the response body and sets a refresh token in an HTTP-only cookie. Rate-limited to 5 requests per minute per IP.
post/users/login
Request body
Example request
{
"email": "user@example.com",
"password": "SecurePassword123!"
}Response
Authentication successful
Example response
{
"message": "Accepted",
"data": {
"onboarding_status": "completed"
}
}