Log in
curl --request POST \
--url https://aropay.aro.media/api/v1/auth/login \
--header 'Content-Type: application/json' \
--data '
{
"email": "you@company.com",
"password": "correct-horse-battery-staple"
}
'const options = {
method: 'POST',
headers: {'Content-Type': 'application/json'},
body: JSON.stringify({email: 'you@company.com', password: 'correct-horse-battery-staple'})
};
fetch('https://aropay.aro.media/api/v1/auth/login', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));import requests
url = "https://aropay.aro.media/api/v1/auth/login"
payload = {
"email": "you@company.com",
"password": "correct-horse-battery-staple"
}
headers = {"Content-Type": "application/json"}
response = requests.post(url, json=payload, headers=headers)
print(response.text){
"ok": true,
"data": {
"user": {
"id": "ckusr0001abcd",
"email": "you@company.com",
"name": "Ada Lovelace",
"company": "Example Corp",
"mustChangePassword": false,
"totpEnabled": false,
"lastLoginAt": "2026-08-13T09:00:00.000Z",
"createdAt": "2026-06-01T12:00:00.000Z"
}
}
}{
"ok": false,
"error": {
"code": "validation_error",
"message": "Request validation failed.",
"details": [
{
"path": "amount",
"message": "Required"
}
]
}
}{
"ok": false,
"error": {
"code": "invalid_credentials",
"message": "Invalid email or password."
}
}{
"ok": false,
"error": {
"code": "account_disabled",
"message": "This account is disabled."
}
}{
"ok": false,
"error": {
"code": "rate_limited",
"message": "Too many requests. Try again shortly."
}
}{
"ok": false,
"error": {
"code": "internal_error",
"message": "An unexpected error occurred."
}
}Auth
Log in
Authenticate with email and password. On success the response sets the
aropay_session cookie (httpOnly, SameSite=Lax, 24 h TTL) and returns
the user.
If the account has TOTP enabled, no session is created yet; the
response instead carries requiresTotp: true and a short-lived
pendingToken to exchange at POST /auth/login/totp.
Limited to 10 attempts per 15 minutes per IP; 5 consecutive failures lock the account for 15 minutes.
POST
/
auth
/
login
Log in
curl --request POST \
--url https://aropay.aro.media/api/v1/auth/login \
--header 'Content-Type: application/json' \
--data '
{
"email": "you@company.com",
"password": "correct-horse-battery-staple"
}
'const options = {
method: 'POST',
headers: {'Content-Type': 'application/json'},
body: JSON.stringify({email: 'you@company.com', password: 'correct-horse-battery-staple'})
};
fetch('https://aropay.aro.media/api/v1/auth/login', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));import requests
url = "https://aropay.aro.media/api/v1/auth/login"
payload = {
"email": "you@company.com",
"password": "correct-horse-battery-staple"
}
headers = {"Content-Type": "application/json"}
response = requests.post(url, json=payload, headers=headers)
print(response.text){
"ok": true,
"data": {
"user": {
"id": "ckusr0001abcd",
"email": "you@company.com",
"name": "Ada Lovelace",
"company": "Example Corp",
"mustChangePassword": false,
"totpEnabled": false,
"lastLoginAt": "2026-08-13T09:00:00.000Z",
"createdAt": "2026-06-01T12:00:00.000Z"
}
}
}{
"ok": false,
"error": {
"code": "validation_error",
"message": "Request validation failed.",
"details": [
{
"path": "amount",
"message": "Required"
}
]
}
}{
"ok": false,
"error": {
"code": "invalid_credentials",
"message": "Invalid email or password."
}
}{
"ok": false,
"error": {
"code": "account_disabled",
"message": "This account is disabled."
}
}{
"ok": false,
"error": {
"code": "rate_limited",
"message": "Too many requests. Try again shortly."
}
}{
"ok": false,
"error": {
"code": "internal_error",
"message": "An unexpected error occurred."
}
}