POST
/
api
/
v1
/
admin
/
auth
/
login
Admin login (step 1 of 2)
curl --request POST \
  --url https://api.example.com/api/v1/admin/auth/login
import requests

url = "https://api.example.com/api/v1/admin/auth/login"

response = requests.post(url)

print(response.text)
const options = {method: 'POST'};

fetch('https://api.example.com/api/v1/admin/auth/login', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));
<?php

$curl = curl_init();

curl_setopt_array($curl, [
CURLOPT_URL => "https://api.example.com/api/v1/admin/auth/login",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "POST",
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}
package main

import (
"fmt"
"net/http"
"io"
)

func main() {

url := "https://api.example.com/api/v1/admin/auth/login"

req, _ := http.NewRequest("POST", url, nil)

res, _ := http.DefaultClient.Do(req)

defer res.Body.Close()
body, _ := io.ReadAll(res.Body)

fmt.Println(string(body))

}
HttpResponse<String> response = Unirest.post("https://api.example.com/api/v1/admin/auth/login")
.asString();
require 'uri'
require 'net/http'

url = URI("https://api.example.com/api/v1/admin/auth/login")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Post.new(url)

response = http.request(request)
puts response.read_body

Overview

The admin surface uses a deliberately separate, MFA-gated auth flow from the user surface. Login is two steps:
  1. POST /admin/auth/login (this page) — verifies email + password and, on success, returns a short-lived mfaTicket. No access or refresh token is issued here.
  2. POST /admin/auth/mfa-verify — exchanges the mfaTicket + a 6-digit TOTP code for the actual accessToken + refreshToken pair.
See Admin auth and MFA for the full rationale (why a separate flow, blast-radius isolation, TOTP enrollment).
This endpoint requires no authentication. It is brute-force surface, so the shared 10-requests-per-minute-per-IP burst limiter is applied.

Authentication

None. Public endpoint.

Path parameters

None.

Query parameters

None.

Request body

FieldTypeRequiredNotesExample
emailstringyesValid email, 5..254 chars. Lower-cased server-side.admin@swappr.co.uk
passwordstringyes1..200 chars. The bootstrap password (or, in Phase 7, a rotated one).correct-horse-battery
deviceFingerprintstringnoOpaque client fingerprint, max 512 chars. Threaded through to the eventual refresh-token row at mfa-verify time.fp_9a3c…

Example payload

{
  "email": "admin@swappr.co.uk",
  "password": "correct-horse-battery"
}

Response — 200 OK

FieldTypeNotesExample
mfaTicketstringA signed, 5-minute JWT (scope admin-mfa-pending). Present it verbatim to /admin/auth/mfa-verify. It is not an access token and grants no API access.eyJhbGciOiJI…
{
  "mfaTicket": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiI2NjQwMGE4Zi…"
}

Error responses

StatusCodeMeaning
400VALIDATION_FAILEDemail/password missing or out of length bounds.
401ADMIN_INVALID_CREDENTIALSWrong password or no admin row with that email. Enumeration-safe — the same code/timing is returned for both so an attacker cannot probe which emails are admins.
409MFA_NOT_ENROLLEDThe admin row exists and the password is correct, but MFA was never enrolled (bootstrap not completed).
ADMIN_INVALID_CREDENTIALS is intentionally returned for both a wrong password and a non-existent admin, and the server pays the full Argon2-verify cost on the missing-admin path so response timing cannot reveal which emails exist.

Example error — 401 ADMIN_INVALID_CREDENTIALS

{
  "type": "https://api.swappr.co.uk/errors/admin-invalid-credentials",
  "title": "Invalid admin credentials",
  "status": 401,
  "code": "ADMIN_INVALID_CREDENTIALS",
  "detail": "Invalid admin credentials",
  "instance": "/api/v1/admin/auth/login",
  "requestId": "01HZQ7K3M4N5P6Q7R8S9T0V1W2"
}

See also

curl

curl -X POST https://api.swappr.co.uk/api/v1/admin/auth/login \
  -H "Content-Type: application/json" \
  -d '{
    "email": "admin@swappr.co.uk",
    "password": "correct-horse-battery"
  }'

Postman

See docs/postman/swappr.postman_collection.jsonAdmin Auth → Login.