Public token endpoints: obtain and refresh access tokens.
/auth/loginLog in with email + password → tokens (incl. refresh token)
Request body object (required, application/json)
200Token bundle.400Request body/params failed validation.401Missing/invalid token.429Rate limit exceeded.503An upstream dependency (e.g./auth/refreshExchange a refresh token for a new access token (no credentials)
Request body object (required, application/json)
200New access/id token.400Request body/params failed validation.401Missing/invalid token.429Rate limit exceeded.503An upstream dependency (e.g.| Field | Type | Required | Description |
|---|---|---|---|
| accessToken | string | optional | AWS Cognito access token; send it on subsequent v2 requests as the `Authorization: Bearer <accessToken>` header. |
| idToken | string | optional | AWS Cognito ID token carrying the authenticated user's identity claims. |
| refreshToken | string | optional | AWS Cognito refresh token used to obtain new access tokens; returned by POST /auth/login but NOT by POST /auth/refresh (the original refresh token stays valid until it expires). |
| expiresIn | integer | optional | Lifetime of the access token in seconds, after which it must be refreshed. |
| tokenType | string | optional | Token type for the Authorization header; always "Bearer". |