POST /api/admin/login, the server creates a session and returns a session cookie. You must include that cookie with every subsequent API request. There are no API keys or bearer tokens — the session cookie is the sole authentication mechanism.
Endpoints
POST /api/admin/login
Validates the provided credentials and opens an admin session.Request body
string
required
The admin account email address. Must be a valid email format.
string
required
The admin account password.
Response fields
string
Human-readable status message.
"Login successful." on success.object
Code example
GET /api/admin/me
Returns the session’s current authenticated user. Use this to confirm a session is still active or to retrieve the logged-in user’s details without re-authenticating.Response fields
string
"Authenticated user loaded." when the session is valid.object
Code example
POST /api/admin/logout
Clears the current admin session. After a successful logout, the session cookie is no longer valid and all protected endpoints will return HTTP 401 until you log in again.Code example
Error handling
When you receive a
401 on any endpoint other than /api/admin/me, your session has expired or was never established. Call POST /api/admin/login again to obtain a new session before retrying.
Validation errors on the login request (e.g. missing
email or malformed email format) are returned as HTTP 422 with a Laravel validation error body, separate from the invalid-credentials 422 shown above.