dashback/docs/api/routes/auth/login.md

POST /auth/login

Public. No cookie required.

Login with Google ID token

Verifies a Google ID token, checks allowlist (or creates entry when IMPLICIT_CREATE=true or when the email has a pending auto-invitation), stores Google sub and profile image bytes, and sets an HTTP-only token cookie. user.picture is the profile image as base64 (same as GET /auth/me).

Body (JSON)

Field	Required	Type	Description
idToken	yes	string	Google ID token from Google Identity Services

{
  "idToken": "<google-id-token>"
}

Response 200

Login successful; token cookie set

{
  "message": "Login successful",
  "user": {
    "id": 1,
    "email": "user@example.com",
    "selectedCompanyId": 1,
    "picture": "…"
  }
}

Errors

Status	Description
400	Missing token or Google client not configured — {"error":"…"}
401	Invalid Google token or account — {"error":"…"}
403	Email not on allowlist or invited — {"error":"…"}
500	Server error — {"error":"…"}

---

Generated from @openapi JSDoc. Do not edit by hand — run npm run docs:api.