API Authentication

How to obtain and use a JWT token to authenticate requests to the Vacaciones API.

The Vacaciones API uses JSON Web Tokens (JWT) for authentication. Every protected endpoint requires a valid token in the Authorization header. The only endpoint that does not require a token is POST /api/auth/login.

Obtaining a token

Exchange a username and password for a JWT by calling the login endpoint.

POST /api/auth/login

username · string · required

The account username.

password · string · required

The account password.

Response

token · string · required

A signed JWT. Include this value in the Authorization header of subsequent requests.

Request

curl -X POST http://localhost:5175/api/auth/login \
  -H "Content-Type: application/json" \
  -d '{"username": "admin", "password": "secret"}'

{
  "token": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6IjEiLCJ1c2VybmFtZSI6ImFkbWluIiwicm9sZSI6ImFkbWluIn0.SIGNATURE"
}

Token payload

The JWT payload contains the following claims:

Claim	Type	Description
id	string	The user’s unique identifier
username	string	The user’s login name
role	"admin" | "user"	The user’s role

You can decode the payload client-side with standard base64 decoding. The front end reads the payload to populate the authenticated user context:

function parseJwt(token: string) {
  const payload = token.split('.')[1];
  const decoded = atob(payload.replace(/-/g, '+').replace(/_/g, '/'));
  return JSON.parse(decodeURIComponent(escape(decoded)));
  // returns { id, username, role }
}

Using the token

Include the token as a Bearer credential in the Authorization header on every protected request:

curl http://localhost:5175/api/personal \
  -H "Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9..."

The front end stores the token in localStorage under the key token and attaches it automatically to every apiFetch call.

Token expiry and logout

When the user logs out, the front end removes the token from localStorage. The server does not provide a token revocation endpoint; tokens remain valid until they expire according to their embedded exp claim.

401 Unauthorized

If a request is made with a missing or invalid token, the server responds with 401 Unauthorized.

All endpoints except POST /api/auth/login return 401 when the Authorization header is absent or the token is expired or malformed. Obtain a fresh token via the login endpoint and retry.