Login

Login #

The Login endpoint authenticates an email/password pair and returns a token pair for your own account: an access token valid for 15 minutes and a rotating refresh token valid for 30 days.

This is the simple first-party path — handy for quick experiments and personal scripts. For anything long-running prefer a personal access token; for apps acting on behalf of other users use the OAuth flow.

Caution The tokens grant access to your books. Treat both — especially the refresh token — as secrets and never embed them in client-side code.

Request #

curl --location --request POST 'https://api.microbooks.io/auth/v1/login' \
--data-raw '{
    "email": "john.doe@example.com",
    "password": "securepassword"
}'

import requests

url = "https://api.microbooks.io/auth/v1/login"
body = {"email": "john.doe@example.com", "password": "securepassword"}

response = requests.post(url, json=body)

print(response.json())

const response = await fetch('https://api.microbooks.io/auth/v1/login', {
    method: 'POST',
    headers: { 'Content-Type': 'application/json' },
    body: JSON.stringify({
        email: 'john.doe@example.com',
        password: 'securepassword'
    })
});
console.log(await response.json());

$client = new Client();
$body = '{
    "email": "john.doe@example.com",
    "password": "securepassword"
}';
$request = new Request('POST', 'https://api.microbooks.io/auth/v1/login',
    ['Content-Type' => 'application/json'],
    $body
);
$res = $client->sendAsync($request)->wait();
echo $res->getBody();

var client = new RestClient("https://api.microbooks.io/auth/v1/login");
var request = new RestRequest(Method.POST);
var body = "{
    \"email\": \"john.doe@example.com\",
    \"password\": \"securepassword\"
}";
request.AddParameter("application/json", body, ParameterType.RequestBody);
IRestResponse response = client.Execute(request);
Console.WriteLine(response.Content);

Response #

{
    "token_type": "Bearer",
    "expires_in": 900,
    "access_token": "eyJ0eXAiOiJKV1QiLCJhbGciOiJSUzI1NiJ9...",
    "refresh_token": "def50200a1b2c3..."
}

When the access token expires, redeem the refresh token at the refresh endpoint.