Login
POST
/auth/loginSign in with an email and password to get your API tokens.
You'll receive two tokens: an **access token** for making API requests, and a
**refresh token** for getting new access tokens when they expire. Access tokens
are short-lived (typically 15 minutes), while refresh tokens last much longer.
Include the access token in the `Authorization: Bearer ` header for all
your API calls.
When to use this
- Building a custom login page for your application
- Authenticating users in a mobile app
- Setting up API access for scripts or integrations
Request Body
Response
Login successful
Notes
💡Store the refresh token securely-you'll need it to get new access tokens without asking users to log in again.
⚠️Never expose tokens in client-side code or version control. Use environment variables or secure storage.
Code Samples
Login using the TypeScript SDK:
import { BackstageClient } from '@ticketlayer/backstage';
const client = new BackstageClient({
organisationSlug: 'your-org',
});
// Authenticate user
const { accessToken, refreshToken, user } = await client.auth.login({
email: 'user@example.com',
password: 'your-password',
});
console.log(`Logged in as ${user.email}`);
console.log(`Access token: ${accessToken.substring(0, 20)}...`);