/v2/auth/loginLog in
Exchange an app key and secret for an access token, and set the refresh cookie.
This is the front door. Send the storefront’s appKey and secret. Only a verified, enabled, customer-facing credential that belongs to this storefront’s agency may enter. Staff credentials are refused even if they look valid — this surface is for the shopper API, not the back office.
The Origin header is required and exact. It must be a registered storefront whose role types include CUSTOMER and which has an agency mapped. That agency must be APPROVED, and must not use PLATFORM_COLLECTS settlement.
cURL
curl -X POST https://user.aerolink.dev/v2/auth/login \
-H "Origin: https://acme.trip963.com" \
-H "Content-Type: application/json" \
-d '{"appKey":"ak_live_4f8c2e91d0ab","secret":"••••••••"}'Headers
OriginstringStorefront origin, for example https://acme.trip963.com
Content-Typeapplication/jsonJSON body
Originstring required | Storefront origin, for example https://acme.trip963.com |
Content-Typeapplication/json required | JSON body |
Request
{
"appKey": "ak_live_4f8c2e91d0ab",
"secret": "••••••••"
}Body fields
appKeystringStorefront application key
secretstringStorefront application secret
appKeystring required | Storefront application key |
secretstring required | Storefront application secret |
Response
{
"message": "Success",
"data": {
"accessToken": "eyJhbGciOiJSUzI1NiIs...",
"expiresIn": 600,
"user": {
"id": "68b1...",
"firstName": "Rahim",
"lastName": "Uddin",
"email": "customer@example.com",
"phoneNumber": "+8801700000000"
}
},
"error": null
}Response fields
accessTokenstringBearer token for every other endpoint
expiresInnumberAccess-token lifetime in seconds
user.idstringCustomer id
user.firstNamestringGiven name
user.lastNamestringFamily name
user.emailstringuser.phoneNumberstringPhone
accessTokenstring | Bearer token for every other endpoint |
expiresInnumber | Access-token lifetime in seconds |
user.idstring | Customer id |
user.firstNamestring | Given name |
user.lastNamestring | Family name |
user.emailstring | |
user.phoneNumberstring | Phone |
Business rules
- Also sets Set-Cookie: refreshToken=…; HttpOnly and Cache-Control: no-store.
- A refresh token is stored on the user (capped at 20, oldest evicted).
- The customer JWT is slim: agency id and country, plus POS for pricing. No agency name, logo or markup.
Errors
appKey or secret missing
Unknown appKey, wrong secret, not customer-only, or wrong storefront. One generic message so credentials cannot be enumerated.
Origin is registered but does not admit CUSTOMER
No Origin header, unregistered origin, no agencyId, agency missing, not APPROVED, or PLATFORM_COLLECTS
| HTTP | message | When |
|---|---|---|
| 400 | validation failed | appKey or secret missing |
| 403 | Invalid Credentials | Unknown appKey, wrong secret, not customer-only, or wrong storefront. One generic message so credentials cannot be enumerated. |
| 403 | Invalid Role | Origin is registered but does not admit CUSTOMER |
| 404 | Invalid Origin | No Origin header, unregistered origin, no agencyId, agency missing, not APPROVED, or PLATFORM_COLLECTS |