> ## Documentation Index
> Fetch the complete documentation index at: https://mintlify.com/No-Country-simulation/S02-26-Equipo-33-Web-App/llms.txt
> Use this file to discover all available pages before exploring further.

# Login

> Authenticate user and receive JWT token

## Endpoint

```
POST /api/auth/login
```

## Authentication

No authentication required.

## Request Body

<ParamField body="email" type="string" required>
  User's email address. Must be a valid email format.
</ParamField>

<ParamField body="password" type="string" required>
  User's password.
</ParamField>

## Response

<ResponseField name="success" type="boolean">
  Indicates whether the login was successful.
</ResponseField>

<ResponseField name="message" type="string">
  Human-readable message describing the result.
</ResponseField>

<ResponseField name="token" type="string">
  JWT authentication token. Expires in 7 days by default.
</ResponseField>

<ResponseField name="user" type="object">
  User information including profile details.

  <ResponseField name="id" type="string">
    User's unique identifier.
  </ResponseField>

  <ResponseField name="email" type="string">
    User's email address.
  </ResponseField>

  <ResponseField name="full_name" type="string">
    User's full name.
  </ResponseField>

  <ResponseField name="role" type="string">
    User's role ("seller" or "admin").
  </ResponseField>

  <ResponseField name="is_email_verified" type="boolean">
    Whether the user's email has been verified.
  </ResponseField>

  <ResponseField name="seller_profile" type="object">
    Seller-specific profile information. Null for admin users.

    <ResponseField name="identity_document" type="string">
      URL or identifier for the seller's identity document.
    </ResponseField>

    <ResponseField name="selfie_url" type="string">
      URL to the seller's selfie image.
    </ResponseField>

    <ResponseField name="verification_status" type="string">
      Verification status: "pending", "verified", or "rejected".
    </ResponseField>

    <ResponseField name="verification_method" type="string">
      Method used for verification: "manual" or "automatic".
    </ResponseField>

    <ResponseField name="verified_at" type="string">
      ISO 8601 timestamp of when verification was completed.
    </ResponseField>

    <ResponseField name="is_verified_badge" type="boolean">
      Whether the seller has a verified badge displayed.
    </ResponseField>
  </ResponseField>
</ResponseField>

## Example Request

<CodeGroup>
  ```bash cURL theme={null}
  curl -X POST https://api.horsetrust.com/api/auth/login \
    -H "Content-Type: application/json" \
    -d '{
      "email": "seller@example.com",
      "password": "securePassword123"
    }'
  ```

  ```javascript JavaScript/TypeScript theme={null}
  const response = await fetch('https://api.horsetrust.com/api/auth/login', {
    method: 'POST',
    headers: {
      'Content-Type': 'application/json'
    },
    body: JSON.stringify({
      email: 'seller@example.com',
      password: 'securePassword123'
    })
  });

  const data = await response.json();

  // Store the token for future requests
  if (data.success) {
    localStorage.setItem('authToken', data.token);
  }
  ```
</CodeGroup>

## Example Response

```json 200 Success theme={null}
{
  "success": true,
  "message": "Login successful",
  "token": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...",
  "user": {
    "id": "507f1f77bcf86cd799439011",
    "email": "seller@example.com",
    "full_name": "John Smith",
    "role": "seller",
    "is_email_verified": false,
    "seller_profile": {
      "verification_status": "pending",
      "is_verified_badge": false
    }
  }
}
```

## Error Responses

<ResponseField name="400" type="error">
  **Bad Request** - Validation error.

  ```json theme={null}
  {
    "success": false,
    "message": "Valid email required"
  }
  ```
</ResponseField>

<ResponseField name="401" type="error">
  **Unauthorized** - Invalid credentials or inactive account.

  ```json theme={null}
  {
    "success": false,
    "message": "Invalid credentials"
  }
  ```
</ResponseField>

<ResponseField name="500" type="error">
  **Server Error** - Internal server error.

  ```json theme={null}
  {
    "success": false,
    "message": "Server error"
  }
  ```
</ResponseField>

## Notes

* Email is normalized and converted to lowercase before authentication
* Only active users (`is_active: true`) can log in
* The `last_login` timestamp is automatically updated upon successful login
* Password comparison is done securely using bcrypt
* The JWT token contains the user's ID and role, and should be included in the `Authorization` header for protected endpoints
* Store the token securely (e.g., httpOnly cookies or secure storage) and never expose it in URLs or logs