Login — Get JWT Token

Authenticates a user with credentials. Returns a pair of access and refresh tokens.

POSThttps://dev.backend.colurs.co/token/

Content-Type: application/jsonAccept: application/jsonx-api-key: [API_KEY]

request.json{
"username": "user@example.com",
"password": "Password123!",
"platform": "API"
}

curl -X POST https://dev.backend.colurs.co/token/ \
-H "Content-Type: application/json" \
-H "Accept: application/json" \
-H "x-api-key: [API_KEY]" \
-d '{
  "username": "user@example.com",
  "password": "Password123!",
  "platform": "API"
}'

{
"access": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...",
"refresh": 
"eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9..."}

{
"code_transaction": "OTPRequiredException",
"message": 
"OTP code is required"}

{
"code_transaction": "CodeMustBeRequiredException",
"message": 
"Verification code is required"}

{
"code_transaction": "CodeExpiredException",
"message": 
"Verification code has expired"}

Use the Token

Include these headers in every authenticated request:

Content-Type: application/json
Accept: application/json
x-api-key: [API_KEY]
Authorization: Bearer [ACCESS_TOKEN]

2FA (MFA) Flow

If the user has two-factor authentication enabled (totp_secret in their profile), login requires an additional step:

1. Send username, password, and platform as usual.
2. The server responds with OTPRequiredException.
3. Resend the same request adding the otp field with the 6-digit authenticator code.
4. If the OTP is valid, you receive the tokens.

Supported Platforms