Login and get a Sanctum token
POST
https://test.diveraid.com/api/v1/auth/login
V1 Auth
Maintainer:rivalex
Overview
Authorization: Bearer {token} header.Auth::attempt() and never starts a session. Credentials are checked directly against the user provider of the api guard.App\Http\Controllers\Api\V1\Auth\AuthController::login()Route name:
api.v1.auth.loginAuthentication
Additional middleware:
throttle:auth — 10 requests per minute per IP address.Request
POSTPath:
/api/v1/auth/loginContent-Type:
application/jsonBody
{
"email": "diver@example.com",
"password": "SecurePass123!",
"device_name": "Alex's iPhone"
}| Field | Type | Required | Validation | Description |
|---|---|---|---|---|
email | string | Yes | required|email:rfc | Registered email address |
password | string | Yes | required|string | Account password |
device_name | string | No | sometimes|string|max:255 | Label for this token, shown to the user on their devices screen |
App\Http\Requests\Api\V1\Auth\LoginRequest.device_name is omitted or blank, the server derives a label from the User-Agent header as {platform} - {browser}, falling back to Unknown for either part, and to Mobile device when neither can be determined. Supplying a meaningful device_name is strongly recommended: it is what the account holder sees when deciding which device to revoke.Example request
Response 200 OK
{
"success": true,
"status": "success",
"message": "OK",
"data": {
"token": "1|raid_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx",
"token_type": "Bearer",
"expires_in": 7775999
}
}Response fields
| Field | Type | Nullable | Always present | Description |
|---|---|---|---|---|
data.token | string | No | Yes | Opaque personal access token. Send it verbatim as Authorization: Bearer {token} |
data.token_type | string | No | Yes | Always Bearer |
data.expires_in | integer | No | Yes | Seconds until expiry. 90 days, so approximately 7776000. Treat it as approximate: it is computed at response time and truncates to the second |
Errors
401 Unauthorized — wrong credentials
{
"success": false,
"status": "error",
"message": "Invalid credentials"
}422 Unprocessable Entity — validation
{
"success": false,
"status": "error",
"message": "Validation failed",
"errors": {
"email": ["The email field must be a valid email address."],
"password": ["The password field is required."]
}
}429 Too Many Requests
{
"success": false,
"status": "error",
"message": "Too many requests"
}Retry-After header present. The throttle:auth limiter allows 10 requests per minute per IP address, shared across register, login, password/forgot and password/reset, counting successful and failed attempts alike.Notes
{id}|raid_{random}, carry no readable payload, and are stored server-side, which is what makes individual revocation possible.* ability.Request
Body Params application/jsonRequired
Responses
Request Request Example
Shell
JavaScript
Java
Swift
curl --location 'https://test.diveraid.com/api/v1/auth/login' \
--header 'Content-Type: application/json' \
--data '{
"email": "{{user_email}}",
"password": "{{user_password}}",
"device_name": "User'\''s iPhone"
}'Response Response Example
200 - Example 1
{
"status": "success",
"message": "string",
"data": {
"token": "string",
"token_type": "Bearer",
"expires_in": 0
}
}Modified at 2026-09-25 16:46:37