Log In
POST/api/portal/auth/login
Authenticate an active buyer with email and password and receive a bearer token. email and password are required; remember (optional, default false) keeps the session longer-lived. Wrong credentials and inactive accounts both return a generic 401 with no indication of which failed.
Request
Responses
- 200
- 401
- 403
- 422
- 429
OK
Response Headers
Unauthorized
Response Headers
Forbidden — the token lacks a required scope, the endpoint is not available to API tokens, or the user behind the token lacks the permission. A human must adjust the token scopes or user permissions; do not retry.
Validation failed — the body is a field → messages map (Laravel shape) or the platform envelope with a stable machine-readable code. Fix the payload and resubmit.
Rate limited — platform limit is 1,000 requests/min; individual tokens may carry lower limits. Honor the Retry-After header before retrying. See the Rate Limits guide.