Authenticates an email/password credential and, on success, issues a Passport bearer token plus the user, company, theme, white-label and (for account companies) plan context. Locked accounts, SSO-only accounts (sso_required), inactive/unverified users, users with no company, and companies with bundle_id < 1 are all rejected before a token is issued.

Auth: Both — public route (no authentication); throttled at 10/min per IP. No partner/account scoping — authenticates any user regardless of role; the returned the account's bundle_id (1=partner, 2=location, 3=account) tells the SPA which role logged in. The endpoint validates the referer host against allowed/white-label hosts via allowHost.

Rate limit: 10 requests/min per IP.

Request

• Body:

Response — { data. } envelope.

• status (string) — "success"
• token (string) — Passport access token
• user (object) — id, username, email, inactive_at (nullable), email_verified_at, phone_number, first_name (person.firstname), last_name (person.lastname), title, role (person.role or "User"), total_location (count of stores reachable by the user)
• company (object) — id, name, bundle_id, plus appended enable_insight_report (0/1), enable_competitive_analysis (0/1), dormant_accounts_enabled (0/1), and included company_option (company_id, who_will_pay, enable_generic_alert, enable_insight_report, enable_competitive_analysis)
• theme_options (string) — JSON string
• white_label (object) — logo, white_url, favicon, title, status, login_logo, company_id, email_templates_enabled
• plan (object|null) — only populated when company.bundle_id == 3 (account). The assigned plan (id, plan_name, status, plan_type, enforcement_mode, is_admin_managed) with features (id, plan_id, feature_name, enabled, hard_stop). Null otherwise.

Error cases (not {data}): 401 "Invalid email or password!" / locked-account message; 403 SSO-required ({sso_required:true, sso_url}) or no-company; 400 white-label not allowed / inactive / email not verified / subscription not active.

Errors: 422 on validation failure.