POST /api/auth/login — Authenticate a Flowmatic Account

POST /api/auth/login — Authenticate with your email and password to receive a JWT access token and refresh token for API requests.

Use this endpoint to authenticate an existing, verified Flowmatic account. You provide your registered email address and password, and Flowmatic returns a short-lived JWT accessToken along with a long-lived refreshToken. Include the accessToken in the Authorization header of every subsequent API request. When the access token expires, use the refreshToken to obtain a new pair without re-entering your credentials.

Endpoint

POST https://api.flowmatic.io/api/auth/login

Request Body

email · string · required

The email address associated with your Flowmatic account. This must match the address used during registration and must belong to a fully verified account.

password · string · required

The password for your Flowmatic account. Passwords are transmitted over HTTPS and never stored or logged in plain text.

Example Request

Request

curl -X POST https://api.flowmatic.io/api/auth/login \
  -H "Content-Type: application/json" \
  -d '{"email": "[e-mail]", "password": "mySecurePass123"}'

Request Body

{
  "email": "[e-mail]",
  "password": "mySecurePass123"
}

Response

{
  "accessToken": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...",
  "refreshToken": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9..."
}

Response Fields

accessToken · string

A signed JWT that proves your identity to the Flowmatic API. This token is short-lived — include it in the Authorization header of every authenticated request using the Bearer scheme. When it expires, use your refreshToken to get a new one from POST /api/auth/refresh-token.

refreshToken · string

A long-lived token used to request new accessToken / refreshToken pairs once your current access token expires. Store this securely — it grants the ability to generate new session credentials without your password. See POST /api/auth/refresh-token for details on token rotation.

Using Your Access Token

Once you have your accessToken, pass it as a Bearer token in the Authorization header on every authenticated Flowmatic API request:

curl https://api.flowmatic.io/api/workflows \
  -H "Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9..."

If your account has not yet been verified via email OTP, the login request will be rejected. Complete the email verification flow first. If you never received or your OTP expired, use Resend OTP to request a fresh code.

Next Steps

• Use your accessToken to authenticate requests to any Flowmatic endpoint that requires authorization.
• When your accessToken expires, call POST /api/auth/refresh-token with your refreshToken to receive a new token pair — no need to log in again.