> ## Documentation Index
> Fetch the complete documentation index at: https://withkazi.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication API — Login, Logout, and Me Endpoints

> Authenticate with the LaraCopilot API using POST /api/admin/login. Returns a session cookie used for all subsequent authenticated requests.

The LaraCopilot API uses server-side session authentication. Send credentials to the login endpoint to establish a session, then include the session cookie on all subsequent requests. Endpoints that require authentication return `401 Unauthorized` when no valid session exists. The logout endpoint destroys the session, and `GET /api/admin/me` lets you inspect the currently authenticated user at any time.

***

## POST /api/admin/login

Validates the provided credentials and creates a new admin session. Returns the authenticated user's name, email, and role on success, or a `422` error when credentials do not match.

<ParamField body="email" type="string" required>
  The email address of the admin account. Must be a valid email format.
</ParamField>

<ParamField body="password" type="string" required>
  The plaintext password for the account.
</ParamField>

<ResponseField name="message" type="string">
  A human-readable status message. Value is `"Login successful."` on success.
</ResponseField>

<ResponseField name="data" type="object">
  The authenticated user object.

  <Expandable title="data fields">
    <ResponseField name="data.name" type="string">
      The display name of the authenticated user, e.g. `"Admin User"`.
    </ResponseField>

    <ResponseField name="data.email" type="string">
      The email address of the authenticated user.
    </ResponseField>

    <ResponseField name="data.role" type="string">
      The role assigned to the user. One of `admin`, `manager`, or `supervisor`.
    </ResponseField>
  </Expandable>
</ResponseField>

**Error responses**

| Status | Condition                                                                            |
| ------ | ------------------------------------------------------------------------------------ |
| `422`  | Credentials do not match any known user. Body: `{"message": "Invalid credentials."}` |

<CodeGroup>
  ```bash Request theme={null}
  curl -X POST https://your-instance.laracopilot.com/api/admin/login \
    -H "Content-Type: application/json" \
    -H "Accept: application/json" \
    -c cookies.txt \
    -d '{
      "email": "admin@business.com",
      "password": "admin123"
    }'
  ```

  ```json 200 Response theme={null}
  {
    "message": "Login successful.",
    "data": {
      "name": "Admin User",
      "email": "admin@business.com",
      "role": "admin"
    }
  }
  ```

  ```json 422 Response theme={null}
  {
    "message": "Invalid credentials."
  }
  ```
</CodeGroup>

***

## POST /api/admin/logout

Destroys the current admin session. No request body is required. The endpoint always returns `200` regardless of whether a session was active.

<ResponseField name="message" type="string">
  Confirmation string. Value is `"Logged out successfully."`.
</ResponseField>

<CodeGroup>
  ```bash Request theme={null}
  curl -X POST https://your-instance.laracopilot.com/api/admin/logout \
    -H "Accept: application/json" \
    -b cookies.txt
  ```

  ```json 200 Response theme={null}
  {
    "message": "Logged out successfully."
  }
  ```
</CodeGroup>

***

## GET /api/admin/me

Returns the user data stored in the current session. Use this endpoint to verify that a session cookie is still valid or to retrieve the logged-in user's identity without re-authenticating.

<ResponseField name="message" type="string">
  A human-readable status message. Value is `"Authenticated user loaded."` on success.
</ResponseField>

<ResponseField name="data" type="object">
  Session user data.

  <Expandable title="data fields">
    <ResponseField name="data.name" type="string">
      The display name stored in the session, e.g. `"Admin User"`.
    </ResponseField>

    <ResponseField name="data.email" type="string">
      The email address stored in the session.
    </ResponseField>

    <ResponseField name="data.logged_in" type="boolean">
      Always `true` when the session is valid.
    </ResponseField>
  </Expandable>
</ResponseField>

**Error responses**

| Status | Condition                                                     |
| ------ | ------------------------------------------------------------- |
| `401`  | No active session found. Body: `{"message": "Unauthorized."}` |

<CodeGroup>
  ```bash Request theme={null}
  curl https://your-instance.laracopilot.com/api/admin/me \
    -H "Accept: application/json" \
    -b cookies.txt
  ```

  ```json 200 Response theme={null}
  {
    "message": "Authenticated user loaded.",
    "data": {
      "name": "Admin User",
      "email": "admin@business.com",
      "logged_in": true
    }
  }
  ```

  ```json 401 Response theme={null}
  {
    "message": "Unauthorized."
  }
  ```
</CodeGroup>