Skip to main content
LaraCopilot uses server-side session authentication. When you post valid admin credentials to POST /api/admin/login, the server creates a session and returns a session cookie. You must include that cookie with every subsequent API request. There are no API keys or bearer tokens — the session cookie is the sole authentication mechanism.

​
Endpoints

MethodPathDescription
POST/api/admin/loginAuthenticate and start a session.
POST/api/admin/logoutInvalidate the current session.
GET/api/admin/meReturn the authenticated user’s details.

​
POST /api/admin/login

Validates the provided credentials and opens an admin session.

​
Request body

​
email
string
required
The admin account email address. Must be a valid email format.
​
password
string
required
The admin account password.

​
Response fields

​
message
string
Human-readable status message. "Login successful." on success.
​
data
object

​
Code example

curl -X POST https://your-domain.com/api/admin/login \
  -H "Content-Type: application/json" \
  -c cookies.txt \
  -d '{
    "email": "admin@business.com",
    "password": "admin123"
  }'

​
GET /api/admin/me

Returns the session’s current authenticated user. Use this to confirm a session is still active or to retrieve the logged-in user’s details without re-authenticating.

​
Response fields

​
message
string
"Authenticated user loaded." when the session is valid.
​
data
object

​
Code example

curl -X GET https://your-domain.com/api/admin/me \
  -H "Accept: application/json" \
  -b cookies.txt

​
POST /api/admin/logout

Clears the current admin session. After a successful logout, the session cookie is no longer valid and all protected endpoints will return HTTP 401 until you log in again.

​
Code example

curl -X POST https://your-domain.com/api/admin/logout \
  -H "Accept: application/json" \
  -b cookies.txt

​
Error handling

HTTP statusConditionMessage
422Credentials did not match any admin account."Invalid credentials."
401Request reached a protected endpoint without a valid session."Unauthorized."
When you receive a 401 on any endpoint other than /api/admin/me, your session has expired or was never established. Call POST /api/admin/login again to obtain a new session before retrying.
Validation errors on the login request (e.g. missing email or malformed email format) are returned as HTTP 422 with a Laravel validation error body, separate from the invalid-credentials 422 shown above.
Store your admin credentials securely. Never commit email/password values to source control or expose them in client-side code. Rotate passwords immediately if they are compromised.