Admin login (step 1 of 2)
Auth
Admin login (step 1 of 2)
First step of the admin two-step login. Verifies email + password and returns a short-lived MFA ticket — NOT tokens.
POST
Admin login (step 1 of 2)
Overview
The admin surface uses a deliberately separate, MFA-gated auth flow from the user surface. Login is two steps:POST /admin/auth/login(this page) — verifies email + password and, on success, returns a short-livedmfaTicket. No access or refresh token is issued here.POST /admin/auth/mfa-verify— exchanges themfaTicket+ a 6-digit TOTP code for the actualaccessToken+refreshTokenpair.
This endpoint requires no authentication. It is brute-force surface, so the shared 10-requests-per-minute-per-IP burst limiter is applied.
Authentication
None. Public endpoint.Path parameters
None.Query parameters
None.Request body
| Field | Type | Required | Notes | Example |
|---|---|---|---|---|
email | string | yes | Valid email, 5..254 chars. Lower-cased server-side. | admin@swappr.co.uk |
password | string | yes | 1..200 chars. The bootstrap password (or, in Phase 7, a rotated one). | correct-horse-battery |
deviceFingerprint | string | no | Opaque client fingerprint, max 512 chars. Threaded through to the eventual refresh-token row at mfa-verify time. | fp_9a3c… |
Example payload
Response — 200 OK
| Field | Type | Notes | Example |
|---|---|---|---|
mfaTicket | string | A signed, 5-minute JWT (scope admin-mfa-pending). Present it verbatim to /admin/auth/mfa-verify. It is not an access token and grants no API access. | eyJhbGciOiJI… |
Error responses
| Status | Code | Meaning |
|---|---|---|
| 400 | VALIDATION_FAILED | email/password missing or out of length bounds. |
| 401 | ADMIN_INVALID_CREDENTIALS | Wrong password or no admin row with that email. Enumeration-safe — the same code/timing is returned for both so an attacker cannot probe which emails are admins. |
| 409 | MFA_NOT_ENROLLED | The admin row exists and the password is correct, but MFA was never enrolled (bootstrap not completed). |
Example error — 401 ADMIN_INVALID_CREDENTIALS
See also
- Admin auth and MFA — the full two-step flow + TOTP enrollment.
- Verify MFA — step 2: exchange the ticket for tokens.
curl
Postman
Seedocs/postman/swappr.postman_collection.json → Admin Auth → Login.