Login

Authenticate a user and obtain a JWT token for subsequent API requests.

POST/apidev/v1/login

PermissionNone (public)

Rate Limit5 req/30s per account

CacheNone

---

Overview

Authenticates a user by email and password and returns a signed JWT token valid for 1 hour. This is a public endpoint — no JWT or API Key required, only the tenant header.

For the full dual-auth model (JWT + API Key) and how to use the token on protected endpoints, see Authentication.

---

Request

Headers

Header	Type	Required	Description
tenant	string	Yes	Your assigned tenant domain (default: geotareas.com) — always send your assigned tenant
Content-Type	string	Yes	Must be application/json

Body Parameters

Parameter	Type	Required	Description
email	string	Yes	User email address
password	string	Yes	User password
playerid	string	No	Push-notification player id to register for this user (max 300)

---

Code Examples

cURL

curl -X POST "https://$TENANT/apidev/v1/login" \
  -H "tenant: $TENANT" \
  -H "Content-Type: application/json" \
  -d '{
    "email": "dev@company.com",
    "password": "your_password"
  }'

JavaScript

const TENANT = "geotareas.com";

const response = await fetch(`https://${TENANT}/apidev/v1/login`, {
  method: "POST",
  headers: {
    "tenant": TENANT,
    "Content-Type": "application/json",
  },
  body: JSON.stringify({
    email: "dev@company.com",
    password: "your_password",
  }),
});

const result = await response.json();
const token = result.data.authorization.token;

Python

import requests

TENANT = "geotareas.com"

response = requests.post(
    f"https://{TENANT}/apidev/v1/login",
    headers={
        "tenant": TENANT,
        "Content-Type": "application/json",
    },
    json={
        "email": "dev@company.com",
        "password": "your_password",
    },
)

result = response.json()
token = result["data"]["authorization"]["token"]

PHP

<?php

$tenant = "geotareas.com";

$ch = curl_init("https://{$tenant}/apidev/v1/login");

curl_setopt_array($ch, [
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_POST           => true,
    CURLOPT_HTTPHEADER     => [
        "tenant: {$tenant}",
        "Content-Type: application/json",
    ],
    CURLOPT_POSTFIELDS     => json_encode([
        "email"    => "dev@company.com",
        "password" => "your_password",
    ]),
]);

$response = curl_exec($ch);
curl_close($ch);

$result = json_decode($response, true);
$token  = $result["data"]["authorization"]["token"];

C#

using System.Net.Http;
using System.Text;
using System.Text.Json;

var tenant = "geotareas.com";

using var client = new HttpClient();
client.DefaultRequestHeaders.Add("tenant", tenant);

var payload = JsonSerializer.Serialize(new
{
    email = "dev@company.com",
    password = "your_password"
});

var content = new StringContent(payload, Encoding.UTF8, "application/json");
var response = await client.PostAsync(
    $"https://{tenant}/apidev/v1/login", content);
var json = await response.Content.ReadAsStringAsync();

using var doc = JsonDocument.Parse(json);
var token = doc.RootElement
    .GetProperty("data")
    .GetProperty("authorization")
    .GetProperty("token")
    .GetString();

---

Response

Success — 200 OK

Field	Type	Description
success	boolean	Always true on success
data.authorization	object	Wrapper object — the token is nested inside
data.authorization.token	string	Signed JWT token, valid for 1 hour. This is the value you send as Authorization: Bearer <token>
meta	object	Empty object

The token is nested

Read the JWT from data.authorization.token, not from data.authorization. Sending the wrapper object as your Bearer credential makes every subsequent call fail with 401 UNAUTHORIZED — with no hint that the token was the problem.

{
  "success": true,
  "data": {
    "authorization": { "token": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9..." }
  },
  "meta": {}
}

---

Errors

HTTP Code	Error Code	Cause
400	VALIDATION_ERROR	Missing or malformed body (e.g. invalid email format, missing password)
401	UNAUTHORIZED	Missing tenant header, or invalid email or password
401	TOKEN_EXPIRED	A previously issued JWT is valid but has passed its 1-hour lifetime
403	COMPANY_SUSPENDED	The company account is suspended — no tokens are issued and every API endpoint returns this code until the account is reactivated. Contact Logicsat support
429	RATE_LIMITED	5+ failed attempts in 30s — account blocked for 60 seconds

{
  "success": false,
  "data": null,
  "error": {
    "code": "UNAUTHORIZED",
    "message": "Invalid email or password."
  }
}

---

Next steps

Once you have the token, attach it alongside your API Key and tenant header on every request. See Using the Token for the exact headers required.