User Login

POST /auth/login

The User Login endpoint authenticates a user's credentials and returns an access token and refresh token for subsequent API requests. A partner would call this endpoint when a user attempts to log in to their account, providing their email address and password. The endpoint verifies the user's credentials and returns their profile information and authentication tokens.

Types inferred from examples. This endpoint came from a Postman collection, which declares no schema — field types are read from the example values and no field is marked required.

Request body

Field	Type	Description
email	stringemail	The user's email address.
password	string	The user's password.

Response 200

Field	Type	Description
status	string	The user's status.
data	object	An object containing additional user data.
username	stringemail	The user's username.
phoneNumber	string	The user's phone number.
firstName	string	The user's first name.
lastName	string	The user's last name.
partnerCode	string	The user's partner code.
realmRoles	array<string>	An array of the user's realm roles.
realmRoles[]	string	A single realm role of the user.
accessToken	string	The user's access token.
emailVerified	boolean	Whether the user's email is verified.
refreshToken	string	The user's refresh token.
expiresIn	integer	The expiration time of the user's access token in seconds.
refreshExpiresIn	integer	The expiration time of the user's refresh token in seconds.
active	boolean	Whether the user is active.

Errors

Status	Meaning
401	401

Environment

Request

curl -X POST "https://api.dev.cslpay.io/auth/login" \
  -H "Authorization: Bearer <access-token>" \
  -H "Content-Type: application/json" \
  -d '{
  "email": "komowele@gmail.com",
  "password": "Omowele@2002"
}'

OkHttpClient client = new OkHttpClient();

String payload = """
    {
      "email": "komowele@gmail.com",
      "password": "Omowele@2002"
    }
""";

RequestBody body = RequestBody.create(
        payload, MediaType.get("application/json"));

Request request = new Request.Builder()
        .url("https://api.dev.cslpay.io/auth/login")
        .post(body)
        .addHeader("Authorization", "Bearer <access-token>")
        .addHeader("Content-Type", "application/json")
        .build();

try (Response response = client.newCall(request).execute()) {
    if (!response.isSuccessful()) {
        throw new IOException("Unexpected status " + response.code());
    }
    System.out.println(response.body().string());
}

const response = await fetch("https://api.dev.cslpay.io/auth/login", {
  method: "POST",
  headers: {
    "Authorization": "Bearer <access-token>",
    "Content-Type": "application/json"
  },
  body: JSON.stringify({
    "email": "komowele@gmail.com",
    "password": "Omowele@2002"
  })
});

const data = await response.json();
console.log(data);

import requests

response = requests.post(
    "https://api.dev.cslpay.io/auth/login",
    headers={
        "Authorization": "Bearer <access-token>",
        "Content-Type": "application/json"
    },
    json={
      "email": "komowele@gmail.com",
      "password": "Omowele@2002"
    },
)

response.raise_for_status()
print(response.json())

Response

200201

{
  "status": "SUCCESS",
  "data": {
    "username": "komowele@gmail.com",
    "phoneNumber": "2347033872435",
    "firstName": "kimberley",
    "lastName": "Omowele",
    "partnerCode": "790598",
    "realmRoles": [
      "IMTO_ADMIN",
      "DEFAULT"
    ],
    "accessToken": "eyJhbGciOiJSUzI1NiIsInR5cCIgOiAiSldUIiwia2lkIiA6ICJoTkc3SmotWjRSX1dtNTEtcGpJWDlWTlBsNlljLUwxNHhZNzB0NDNBQkJ3In0.eyJleHAiOjE3ODY0OTUzNzEsImlhdCI6MTc4NjQ1OTM3MSwianRpIjoiODAyOWRmMDktNGEyMS00OGM1LTg1MWItNjgxYzg0MDAzMTI2IiwiaXNzIjoiaHR0cHM6Ly9rZXljbG9hay5tZ3QuY3NscGF5LmlvL3JlYWxtcy9tYXN0ZXIiLCJhdWQiOiJhY2NvdW50Iiwic3ViIjoiNTVkMGM1MGUtNGZiNi00NTUzLTllMWQtZTZlNmYwZGYyNzBmIiwidHlwIjoiQmVhcmVyIiwiYXpwIjoiYWRtaW4tY2xpIiwic2Vzc2lvbl9zdGF0ZSI6ImZhOWM5NjUzLTdjNjgtNGM3Yy05YTY2LTgyNjYxZWVjYWU5NSIsImFjciI6IjEiLCJyZWFsbV9hY2Nlc3MiOnsicm9sZXMiOlsiZGVmYXVsdC1yb2xlcy1tYXN0ZXIiLCJvZmZsaW5lX2FjY2VzcyIsInVtYV9hdXRob3JpemF0aW9uIiwiaW10by1hZG1pbiJdfSwicmVzb3VyY2VfYWNjZXNzIjp7ImFjY291bnQiOnsicm9sZXMiOlsibWFuYWdlLWFjY291bnQiLCJtYW5hZ2UtYWNjb3VudC1saW5rcyIsInZpZXctcHJvZmlsZSJdfX0sInNjb3BlIjoicm9sZXMgZW1haWwgcHJvZmlsZSIsInNpZCI6ImZhOWM5NjUzLTdjNjgtNGM3Yy05YTY2LTgyNjYxZWVjYWU5NSIsInBob25lTnVtYmVyIjoiMjM0NzAzMzg3MjQzNSIsImVtYWlsX3ZlcmlmaWVkIjp0cnVlLCJwYXJ0bmVyQ29kZSI6Ijc5MDU5OCIsIm5hbWUiOiJraW1iZXJsZXkgT21vd2VsZSIsInByZWZlcnJlZF91c2VybmFtZSI6ImtvbW93ZWxlQGdtYWlsLmNvbSIsImdpdmVuX25hbWUiOiJraW1iZXJsZXkiLCJmYW1pbHlfbmFtZSI6Ik9tb3dlbGUiLCJlbWFpbCI6ImtvbW93ZWxlQGdtYWlsLmNvbSIsInByb2RVc2VyIjoiZmFsc2UifQ.apWVcCo-8bsRWxRTu4JztyWGmm7mF7jzbTN1IA3dUhdXBaeZOWNyv6i9TgMWd5QhTrErogbkGm3SVUqESj-C2TaC8RLXzZFYjTKZ4rMfMgM0NzdQaXdjNYHQg5zqmxxhB8NHkxaMhRxP_q-BguEWY0LyfC7mkrr-eWHg5Sfj4JjtnXhv8unyBz4tbPydjEyQuHEKfYJCF8VoAGCVk24GnOAFDWBNsfKjet4RxELYWDDA9sJ4u_oukPT6ydRWhS_Sr7rl9I3C5FRRmMfpeB7RQIrH-khc6mUOHzu-TcxP3btZGtEABugn9EKUoQ8Z4hLQYezx163z2RQHvJw_P0x1cA",
    "emailVerified": true,
    "refreshToken": "eyJhbGciOiJIUzUxMiIsInR5cCIgOiAiSldUIiwia2lkIiA6ICIzY2UxMDZiYS04ODIyLTQ0OWMtYWI1MS1iNjhiNTZlMGVlNzQifQ.eyJleHAiOjE3ODY0OTUzNzEsImlhdCI6MTc4NjQ1OTM3MSwianRpIjoiYjAyMGRjYzgtOTEzZC00ZGEyLTk3OWYtOWI2NGNmYmJiMTQzIiwiaXNzIjoiaHR0cHM6Ly9rZXljbG9hay5tZ3QuY3NscGF5LmlvL3JlYWxtcy9tYXN0ZXIiLCJhdWQiOiJodHRwczovL2tleWNsb2FrLm1ndC5jc2xwYXkuaW8vcmVhbG1zL21hc3RlciIsInN1YiI6IjU1ZDBjNTBlLTRmYjYtNDU1My05ZTFkLWU2ZTZmMGRmMjcwZiIsInR5cCI6IlJlZnJlc2giLCJhenAiOiJhZG1pbi1jbGkiLCJzZXNzaW9uX3N0YXRlIjoiZmE5Yzk2NTMtN2M2OC00YzdjLTlhNjYtODI2NjFlZWNhZTk1Iiwic2NvcGUiOiJyb2xlcyBlbWFpbCBwcm9maWxlIiwic2lkIjoiZmE5Yzk2NTMtN2M2OC00YzdjLTlhNjYtODI2NjFlZWNhZTk1In0.q451-w3uebERcaF7Ybja2LlaQpaEIG3e6R3V1ZVGmRgIoDmSDdmFIoSg7QGsPy8F05BxqOsB0K6BdHwPlpi67A",
    "expiresIn": 36000,
    "refreshExpiresIn": 36000,
    "active": false
  }
}

401401

{
  "type": "https://developer.mozilla.org/en-US/docs/Web/HTTP/Status",
  "title": "UNAUTHORIZED",
  "status": 401,
  "detail": "Invalid User Credentials. Please Check Your Username And Password.",
  "instance": "/auth/login",
  "properties": {
    "timestamp": "2026-08-11T14:38:40.631583306Z"
  }
}

Authorization

Authorization: Bearer <access-token>

Sent on every request. See Getting started.