N1 APIDemo shop

AUTH / Sign-in

POST

/auth/login

Mock

Mock. This operation is part of the approved contract but its module is not built yet. Run Core with N1_API_MODE=mock N1_DEV_AUTH=stub to get deterministic demo-shop data from it. The real server answers NOT_IMPLEMENTED until it ships; the schema and examples here will not change when it does.

Sign in with email or phone and password

Compare

Exchanges an email or phone number and a password for a 15-minute access token and a rotating refresh token. Send the access token as Authorization: Bearer … to /graphql. The answer is the same for an unknown user and a wrong password.

POST/auth/login

Who can call this. None: public.

Headers

  • X-Request-IdstringOptional

    Your id for this request (8–128 characters of A–Z a–z 0–9 . _ : -). Echoed back in the response header and in every error, so you can quote it when reporting a problem. Core makes one if you send none.

    Example: app-7f3c2a9e-checkout

Returns

A small JSON object; see the response examples on the right.

Errors

CodeHTTPWhen
INVALID_CREDENTIALS401Login failed. The same answer for an unknown user and a wrong password, so it cannot be used to find out who has an account.
VALIDATION_FAILED400Input failed Zod or route schema validation. details lists each field path and problem.

Every error has the same body. See Errors.

Rate limit tier

Tier: per IP. Over the limit you get RATE_LIMITED (HTTP 429) with a Retry-After header. See Response handling.