> ## Documentation Index
> Fetch the complete documentation index at: https://mintlify.com/CKoldo/Vacaciones-front/llms.txt
> Use this file to discover all available pages before exploring further.

# API Authentication

> How to obtain and use a JWT token to authenticate requests to the Vacaciones API.

The Vacaciones API uses JSON Web Tokens (JWT) for authentication. Every protected endpoint requires a valid token in the `Authorization` header. The only endpoint that does not require a token is `POST /api/auth/login`.

## Obtaining a token

Exchange a username and password for a JWT by calling the login endpoint.

### `POST /api/auth/login`

<ParamField body="username" type="string" required>
  The account username.
</ParamField>

<ParamField body="password" type="string" required>
  The account password.
</ParamField>

**Response**

<ResponseField name="token" type="string" required>
  A signed JWT. Include this value in the `Authorization` header of subsequent requests.
</ResponseField>

<CodeGroup>
  ```bash Request theme={null}
  curl -X POST http://localhost:5175/api/auth/login \
    -H "Content-Type: application/json" \
    -d '{"username": "admin", "password": "secret"}'
  ```

  ```json Response theme={null}
  {
    "token": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6IjEiLCJ1c2VybmFtZSI6ImFkbWluIiwicm9sZSI6ImFkbWluIn0.SIGNATURE"
  }
  ```
</CodeGroup>

## Token payload

The JWT payload contains the following claims:

| Claim      | Type                | Description                  |
| ---------- | ------------------- | ---------------------------- |
| `id`       | `string`            | The user's unique identifier |
| `username` | `string`            | The user's login name        |
| `role`     | `"admin" \| "user"` | The user's role              |

You can decode the payload client-side with standard base64 decoding. The front end reads the payload to populate the authenticated user context:

```typescript theme={null}
function parseJwt(token: string) {
  const payload = token.split('.')[1];
  const decoded = atob(payload.replace(/-/g, '+').replace(/_/g, '/'));
  return JSON.parse(decodeURIComponent(escape(decoded)));
  // returns { id, username, role }
}
```

## Using the token

Include the token as a Bearer credential in the `Authorization` header on every protected request:

```bash theme={null}
curl http://localhost:5175/api/personal \
  -H "Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9..."
```

The front end stores the token in `localStorage` under the key `token` and attaches it automatically to every `apiFetch` call.

## Token expiry and logout

When the user logs out, the front end removes the token from `localStorage`. The server does not provide a token revocation endpoint; tokens remain valid until they expire according to their embedded `exp` claim.

## 401 Unauthorized

If a request is made with a missing or invalid token, the server responds with `401 Unauthorized`.

<Warning>
  All endpoints except `POST /api/auth/login` return `401` when the `Authorization` header is absent or the token is expired or malformed. Obtain a fresh token via the login endpoint and retry.
</Warning>