# Authentication

Authentication is handled via OAuth-style bearer tokens. Access tokens are valid for **24 hours** (14 days when `rememberMe` is set to `true`). When a token expires, the API responds with a `401` error (`token_expired`): authenticate again via this endpoint to obtain a new token. Tokens should be stored securely.

### Login

### `POST /oauth/login` - Request Access Token

Exchange your credentials for an access token.

#### Request Body

```json
rememberMe=true
username=myEmail@emailProvider.com
password=myPassword
grant_type=password
```

##### Request Body Properties

Every field in the example is listed below. Explicit requiredness is shown when the endpoint contract defines it.

| Property | Type | Example | Description |
| --- | --- | --- | --- |
| rememberMe | boolean | true | The remember me value. |
| username | string | myEmail@emailProvider.com | The username value. |
| password | string | myPassword | The password value. |
| grant\_type | string | password | The grant type value. |

#### Response

```json
{
  "access_token": "eyJhbGciOiJIUzI1...",
  "status": 201,
  "code": "token_created",
  "message": "You have successfully logged in.",
  "data": {
    "user": {
      "userId": 1,
      "email": "user@example.com",
      "role": "brand",
      "brandId": 100
    }
  },
  "token_type": "Bearer"
}
```

##### Response Properties

Every field in the example is listed below. Explicit requiredness is shown when the endpoint contract defines it.

| Property | Type | Example | Description |
| --- | --- | --- | --- |
| access\_token | string | "eyJhbGciOiJIUzI1..." | The access token value. |
| status | integer | 201 | HTTP status code returned by the API. |
| code | string | "token\_created" | Machine-readable application code for the result. |
| message | string | "You have successfully logged in." | Human-readable result message. Do not use this value for program logic. |
| data | object | {…} | Endpoint-specific response payload. |
| data.user | object | {…} | Object containing user fields. |
| data.user.userId | integer | 1 | Identifier of the user. |
| data.user.email | string | "user@example.com" | Email address. |
| data.user.role | string | "brand" | The role value. |
| data.user.brandId | integer | 100 | Identifier of the brand. |
| token\_type | string | "Bearer" | The token type value. |

#### Using the Token

Include the token in the Authorization header of subsequent requests:  
`Authorization: Bearer <token>`