Authentication
User email address
User password
Login successful
Authentication token for the user session.
Use this token in the Authorization: Token <key> header
for subsequent API requests, or it will be used automatically
via TokenAuthentication.
9a8b7c6d5e4f3a2b1c0d9e8f7a6b5c4d3e2f1a0bOptional redirect URL derived from 'next' query parameter. Will be null if no redirect was specified.
Invalid credentials or email not verified
Too many login attempts (throttled)
Phone number that matches an existing active user in the system. Phone number must pass the configured phone regex validator. Returns 400 error if no user exists with this phone number.
05355555555SMS verification code received in Step 1.
- Omit this field on first request to receive OTP via SMS
- Include this field with the received code to complete login
- Code expiration is controlled by
SMS_OTP_EXPIRE_TIMEsetting
123456- With valid
code: Login successful, returns authentication token - Without
code: OTP sent successfully (empty response body)
Empty response when OTP is sent
Validation errors:
- Phone number doesn't exist in system
- Phone number format is invalid
- Code length is invalid (less than 4 characters)
- Incorrect OTP code
- OTP code expired
Too many login attempts (throttled)
CSRF token for state-changing requests
URL referrer. If starts with account index path (reverse of 'account-index'), redirects to home page.
/users/profile/URL to redirect after logout. Must be a valid resolvable path. Falls back to adapter's logout redirect if invalid.
/basket/Redirect to specified or default logout URL
Redirect to specified or default logout URL
No content
Admin authentication using Token Authentication.
Requires user to have admin/staff privileges.
Include token in Authorization header as: Authorization: Token <token>
User ID for whom to generate the one-time login token. Must be an active user in the system.
123Secret key used for token generation and validation.
This same key must be provided when using the generated token
at /users/passwordless-login/{token}/ endpoint.
user-login-secretToken generated successfully
Partial URL path containing only the token.
Format: /users/passwordless-login/{token}/
Important: This is NOT a complete URL. The admin must append query
parameters user and secret_key to create the full login link:
/users/passwordless-login/{token}/?user={user_id}&secret_key={secret_key}
Token expires after PASSWORDLESS_LOGIN_MAX_AGE seconds (default: 300).
/users/passwordless-login/1a2b3c4d5e6f7-8g9h0i1j2k3l4m5n6o7p/Validation errors:
- User ID doesn't exist
- User is not active
- Missing required fields
Authentication required
Admin permission required
One-time login token generated by the admin API.
1a2b3c4d5e6f7-8g9h0i1j2k3l4m5n6o7pUser ID for token validation
123Secret key used for token generation and validation. Must match the key used when creating the token.
user-login-secretURL to redirect after successful login. Defaults to home page if not provided.
/dashboard/- Valid token: User logged in, redirected to 'next' URL or home
- Invalid/expired token: Redirected to home page
- Valid token: User logged in, redirected to 'next' URL or home
- Invalid/expired token: Redirected to home page
No content
User ID. Must be an active user in the system. Returns 400 if user doesn't exist or is inactive.
123User's authentication token.
This is the same token returned from /users/login endpoint.
Must match the token associated with the specified user.
9a8b7c6d5e4f3a2b1c0d9e8f7a6b5c4d3e2f1a0bLogin successful, session established
No content
Validation errors:
- User ID doesn't exist or user is not active
- Token doesn't exist for the specified user
- Token doesn't match user's auth token
No content
Last updated
Was this helpful?