User Login

POST /auth/login

The User Login endpoint authenticates a user's credentials and returns an access token and refresh token for subsequent API requests. A partner would call this endpoint when a user attempts to log in to their account, providing their email address and password. The endpoint verifies the user's credentials and returns their profile information and authentication tokens.

Types inferred from examples. This endpoint came from a Postman collection, which declares no schema — field types are read from the example values and no field is marked required.

Request body

email string

The user's email address.
password string

The user's password.

Response 201

status string

The user's status.
data object12 fields

An object containing additional user data.
- username string
  
  The user's username.
- phoneNumber string
  
  The user's phone number.
- firstName string
  
  The user's first name.
- lastName string
  
  The user's last name.
- partnerCode string
  
  The user's partner code.
- realmRoles array
  
  An array of the user's realm roles.
- accessToken string
  
  The user's access token.
- emailVerified boolean
  
  Whether the user's email is verified.
- refreshToken string
  
  The user's refresh token.
- expiresIn integer
  
  The expiration time of the user's access token in seconds.
- refreshExpiresIn integer
  
  The expiration time of the user's refresh token in seconds.
- active boolean
  
  Whether the user is active.

Errors

Status	Meaning
401	401

Environment

Request

curl -X POST "https://api.dev.cslpay.io/auth/login" \
  -H "Content-Type: application/json" \
  -d '{
  "email": "komowele@gmail.com",
  "password": "Omowele@2002"
}'

OkHttpClient client = new OkHttpClient();

String payload = """
    {
      "email": "komowele@gmail.com",
      "password": "Omowele@2002"
    }
""";

RequestBody body = RequestBody.create(
        payload, MediaType.get("application/json"));

Request request = new Request.Builder()
        .url("https://api.dev.cslpay.io/auth/login")
        .post(body)
        .addHeader("Content-Type", "application/json")
        .build();

try (Response response = client.newCall(request).execute()) {
    if (!response.isSuccessful()) {
        throw new IOException("Unexpected status " + response.code());
    }
    System.out.println(response.body().string());
}

const response = await fetch("https://api.dev.cslpay.io/auth/login", {
  method: "POST",
  headers: {
    "Content-Type": "application/json"
  },
  body: JSON.stringify({
    "email": "komowele@gmail.com",
    "password": "Omowele@2002"
  })
});

const data = await response.json();
console.log(data);

import requests

response = requests.post(
    "https://api.dev.cslpay.io/auth/login",
    headers={
        "Content-Type": "application/json"
    },
    json={
      "email": "komowele@gmail.com",
      "password": "Omowele@2002"
    },
)

response.raise_for_status()
print(response.json())

Response

201Successful

{
  "status": "SUCCESS",
  "data": {
    "username": "komowele@gmail.com",
    "phoneNumber": "2347033872435",
    "firstName": "kimberley",
    "lastName": "Omowele",
    "partnerCode": "790598",
    "realmRoles": [
      "IMTO_ADMIN",
      "DEFAULT"
    ],
    "accessToken": "eyJhbGciOiJSUzI1NiIsInR5cCIgOiAiSldUIiwia2lkIiA6ICJoTkc3SmotWjRSX1dtNTEtcGpJWDlWTlBsNlljLUwxNHhZNzB0NDNBQkJ3In0.eyJleHAiOjE3ODY0OTUzNzEsImlhdCI6MTc4NjQ1OTM3MSwianRpIjoiODAyOWRmMDktNGEyMS00OGM1LTg1MWItNjgxYzg0MDAzMTI2IiwiaXNzIjoiaHR0cHM6Ly9rZXljbG9hay5tZ3QuY3NscGF5LmlvL3JlYWxtcy9tYXN0ZXIiLCJhdWQiOiJhY2NvdW50Iiwic3ViIjoiNTVkMGM1MGUtNGZiNi00NTUzLTllMWQtZTZlNmYwZGYyNzBmIiwidHlwIjoiQmVhcmVyIiwiYXpwIjoiYWRtaW4tY2xpIiwic2Vzc2lvbl9zdGF0ZSI6ImZhOWM5NjUzLTdjNjgtNGM3Yy05YTY2LTgyNjYxZWVjYWU5NSIsImFjciI6IjEiLCJyZWFsbV9hY2Nlc3MiOnsicm9sZXMiOlsiZGVmYXVsdC1yb2xlcy1tYXN0ZXIiLCJvZmZsaW5lX2FjY2VzcyIsInVtYV9hdXRob3JpemF0aW9uIiwiaW10by1hZG1pbiJdfSwicmVzb3VyY2VfYWNjZXNzIjp7ImFjY291bnQiOnsicm9sZXMiOlsibWFuYWdlLWFjY291bnQiLCJtYW5hZ2UtYWNjb3VudC1saW5rcyIsInZpZXctcHJvZmlsZSJdfX0sInNjb3BlIjoicm9sZXMgZW1haWwgcHJvZmlsZSIsInNpZCI6ImZhOWM5NjUzLTdjNjgtNGM3Yy05YTY2LTgyNjYxZWVjYWU5NSIsInBob25lTnVtYmVyIjoiMjM0NzAzMzg3MjQzNSIsImVtYWlsX3ZlcmlmaWVkIjp0cnVlLCJwYXJ0bmVyQ29kZSI6Ijc5MDU5OCIsIm5hbWUiOiJraW1iZXJsZXkgT21vd2VsZSIsInByZWZlcnJlZF91c2VybmFtZSI6ImtvbW93ZWxlQGdtYWlsLmNvbSIsImdpdmVuX25hbWUiOiJraW1iZXJsZXkiLCJmYW1pbHlfbmFtZSI6Ik9tb3dlbGUiLCJlbWFpbCI6ImtvbW93ZWxlQGdtYWlsLmNvbSIsInByb2RVc2VyIjoiZmFsc2UifQ.apWVcCo-8bsRWxRTu4JztyWGmm7mF7jzbTN1IA3dUhdXBaeZOWNyv6i9TgMWd5QhTrErogbkGm3SVUqESj-C2TaC8RLXzZFYjTKZ4rMfMgM0NzdQaXdjNYHQg5zqmxxhB8NHkxaMhRxP_q-BguEWY0LyfC7mkrr-eWHg5Sfj4JjtnXhv8unyBz4tbPydjEyQuHEKfYJCF8VoAGCVk24GnOAFDWBNsfKjet4RxELYWDDA9sJ4u_oukPT6ydRWhS_Sr7rl9I3C5FRRmMfpeB7RQIrH-khc6mUOHzu-TcxP3btZGtEABugn9EKUoQ8Z4hLQYezx163z2RQHvJw_P0x1cA",
    "emailVerified": true,
    "refreshToken": "eyJhbGciOiJIUzUxMiIsInR5cCIgOiAiSldUIiwia2lkIiA6ICIzY2UxMDZiYS04ODIyLTQ0OWMtYWI1MS1iNjhiNTZlMGVlNzQifQ.eyJleHAiOjE3ODY0OTUzNzEsImlhdCI6MTc4NjQ1OTM3MSwianRpIjoiYjAyMGRjYzgtOTEzZC00ZGEyLTk3OWYtOWI2NGNmYmJiMTQzIiwiaXNzIjoiaHR0cHM6Ly9rZXljbG9hay5tZ3QuY3NscGF5LmlvL3JlYWxtcy9tYXN0ZXIiLCJhdWQiOiJodHRwczovL2tleWNsb2FrLm1ndC5jc2xwYXkuaW8vcmVhbG1zL21hc3RlciIsInN1YiI6IjU1ZDBjNTBlLTRmYjYtNDU1My05ZTFkLWU2ZTZmMGRmMjcwZiIsInR5cCI6IlJlZnJlc2giLCJhenAiOiJhZG1pbi1jbGkiLCJzZXNzaW9uX3N0YXRlIjoiZmE5Yzk2NTMtN2M2OC00YzdjLTlhNjYtODI2NjFlZWNhZTk1Iiwic2NvcGUiOiJyb2xlcyBlbWFpbCBwcm9maWxlIiwic2lkIjoiZmE5Yzk2NTMtN2M2OC00YzdjLTlhNjYtODI2NjFlZWNhZTk1In0.q451-w3uebERcaF7Ybja2LlaQpaEIG3e6R3V1ZVGmRgIoDmSDdmFIoSg7QGsPy8F05BxqOsB0K6BdHwPlpi67A",
    "expiresIn": 36000,
    "refreshExpiresIn": 36000,
    "active": false
  }
}

401401

{
  "type": "https://developer.mozilla.org/en-US/docs/Web/HTTP/Status",
  "title": "UNAUTHORIZED",
  "status": 401,
  "detail": "Invalid User Credentials. Please Check Your Username And Password.",
  "instance": "/auth/login",
  "properties": {
    "timestamp": "2026-08-11T14:38:40.631583306Z"
  }
}

Authorization

No token required. This endpoint is how you obtain one.

Try it

POST /auth/login

Requests go to your test environment only. Nothing here reaches production, and your token is forwarded once and never stored.

Environment Request URL

POST

This endpoint needs no token — it is how you obtain one.

Request Body

JSON. Edited here, not saved.

Response

Response headers