Session

post/authenticateexperimentalBez uwierzytelniania

The only way a script obtains a session today. On success sets two cookies: `session` (httpOnly, carries the session id) and `csrf-token` (readable by JavaScript). Every mutating request afterwards - anything but GET, HEAD and OPTIONS - must send the `csrf-token` cookie's value back as the `X-CSRF-Token` header, or it is refused with 403; GET requests need only the `session` cookie. A cookie jar makes this workable from a script; a browser on another origin cannot call it (no CORS, `SameSite=Lax` cookies). Responds 400 when the body fails validation and 401 when the email or password is wrong.

Limit żądań: 10 na 900 sekund.

Treść żądania

Pole	Typ	Wymagane	Ograniczenia	Opis
email	string	Tak	`format: "email"`	-
password	string	Tak	-	-

Przykład

{
  "email": "kamil@example.com",
  "password": "correct horse battery staple"
}

Odpowiedzi

200Success
Pole Typ Wymagane Ograniczenia Opis
user AuthenticatedUser Tak - The signed-in account, as returned by the endpoint that grants the session.
Przykład
```
{
  "user": {
    "uid": "uid-1",
    "email": "kamil@example.com",
    "name": "Kamil",
    "locale": "en"
  }
}
```
400The request body does not match the schema
Brak treści.
401Not authenticated
Brak treści.

Pole	Typ	Wymagane	Ograniczenia	Opis
user	AuthenticatedUser	Tak	-	The signed-in account, as returned by the endpoint that grants the session.

Przykładowe żądanie

curl -X POST 'https://mercastra.cloud/api/authenticate' \
  -H 'Content-Type: application/json' \
  -d '{"email":"kamil@example.com","password":"correct horse battery staple"}'

Sign in with email and password

Treść żądania

Odpowiedzi

Przykładowe żądanie

End the caller's session

Odpowiedzi

Przykładowe żądanie