u

docs/api/routes/auth/login.md

@@ -2,25 +2,38 @@
 
 Public. No cookie required.
 
-**Body (JSON)**
+Login with Google ID token
+
+Verifies a Google ID token, checks allowlist (or creates entry when `IMPLICIT_CREATE=true`), and sets an HTTP-only `token` cookie.
+
+## Body (JSON)
 
 ```json
-{ "idToken": "<google-id-token>" }
+{
+  "idToken": "<google-id-token>"
+}
 ```
 
-**200**
+## Response `200`
+
+Login successful; `token` cookie set
 
 ```json
 {
   "message": "Login successful",
-  "user": { "id": 1, "email": "you@example.com", "picture": "https://lh3.googleusercontent.com/..." }
+  "user": { … }
 }
 ```
 
-**Errors**
+## Errors
 
-| Status | Body |
-|--------|------|
-| 400 | `{ "error": "idToken is required" }` or `{ "error": "GOOGLE_CLIENT_ID is not configured" }` |
-| 401 | `{ "error": "Invalid Google token" }` or `{ "error": "Invalid Google account" }` |
-| 403 | `{ "error": "Email is not authorized" }` |
+| Status | Description |
+|--------|-------------|
+| 400 | Missing token or Google client not configured — `{"error":"…"}` |
+| 401 | Invalid Google token or account — `{"error":"…"}` |
+| 403 | Email not on allowlist — `{"error":"…"}` |
+| 500 | Server error — `{"error":"…"}` |
+
+---
+
+_Generated from `@openapi` JSDoc. Do not edit by hand — run `npm run docs:api`._