dashback/docs/api/routes/auth/login.md

POST /auth/login

Public. No cookie required.

Login with Google ID token

Verifies a Google ID token, checks allowlist (or creates entry when IMPLICIT_CREATE=true), stores Google sub and profile image bytes, and sets an HTTP-only token cookie. user.picture is the profile image as base64 (same as GET /auth/me).

Body (JSON)

{
  "idToken": "<google-id-token>"
}

Response 200

Login successful; token cookie set

{
  "message": "Login successful",
  "user": { … }
}

Errors

Status	Description
400	Missing token or Google client not configured — {"error":"…"}
401	Invalid Google token or account — {"error":"…"}
403	Email not on allowlist — {"error":"…"}
500	Server error — {"error":"…"}

---

Generated from @openapi JSDoc. Do not edit by hand — run npm run docs:api.