Skip to main content
POST
/
admin
/
login
User login (Admin or Processor)
curl --request POST \
  --url https://olive-gateway-a6ba.onrender.com/api/v1/admin/login \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --data '
{
  "email": "<string>",
  "password": "<string>"
}
'
{
  "expires_at": 123,
  "refresh_expires_at": 123,
  "refresh_token": "<string>",
  "success": true,
  "token": "<string>",
  "user": {
    "account_id": "<string>",
    "agent_id": "<string>",
    "created_at": "<string>",
    "email": "<string>",
    "first_name": "<string>",
    "id": "<string>",
    "last_login_at": "<string>",
    "last_name": "<string>",
    "name": "<string>",
    "pep_access_authorized": true,
    "phone_number": "<string>",
    "role": "<string>",
    "status": "<string>",
    "user_type": "<string>"
  }
}
The login endpoint authenticates admin users and processors, returning JWT tokens for session-based access.

Endpoint

POST /api/v1/admin/login

Request Body

email
string
required
User email address
password
string
required
User password

User Types

Admin Users

Dashboard users with roles like system_admin, compliance_user, super_agent

Processors

Merchant accounts for POS terminal management

Example

curl -X POST "https://demo.api.vultlocal.com/api/v1/admin/login" \
  -H "Content-Type: application/json" \
  -d '{
    "email": "admin@olive.sl",
    "password": "SecureP@ss123"
  }'

Token Management

1

Login

Receive access token (15 min) and refresh token (7 days)
2

Use Token

Include in Authorization: Bearer <token> header
3

Refresh

When expired, use refresh endpoint to get new tokens
4

Logout

Revoke refresh token when logging out

User Roles

RoleAccess Level
system_adminFull system access
compliance_userCompliance monitoring
support_userCustomer support
sales_userSales operations
audit_userRead-only audit access
super_agentAgent network management
sub_agentField agent operations
processorPOS merchant dashboard

Errors

CodeErrorDescription
400INVALID_REQUESTMissing email or password
401INVALID_CREDENTIALSWrong email or password
401ACCOUNT_INACTIVEUser account is not active
500INTERNAL_ERRORServer error

Security Notes

  • Login attempts are logged for audit
  • Failed attempts may trigger account lockout
  • Access tokens expire after 15 minutes
  • Always use HTTPS in production

Refresh Token

Get new access token

Logout

Revoke refresh token

Current User

Get current user info

Authorizations

Authorization
string
header
required

Bearer authentication header of the form Bearer <token>, where <token> is your auth token.

Body

application/json

Login credentials

email
string
required
password
string
required

Response

OK

expires_at
integer
refresh_expires_at
integer
refresh_token
string
success
boolean
token
string
user
object