> ## Documentation Index
> Fetch the complete documentation index at: https://docs.capedigital.co.ke/llms.txt
> Use this file to discover all available pages before exploring further.

# Login with username and password

> Authenticate user and obtain access tokens.

This endpoint authenticates a user with Keycloak and returns
JWT access and refresh tokens for API access.



## OpenAPI

````yaml /openapi/user.yaml post /api/v1/auth/login
openapi: 3.0.3
info:
  title: CapeMedia User Service API
  version: 1.0.0
  description: |2-

        **CapeMedia User Service API** - Comprehensive user service and management system.

        ## Authentication
        This API uses **JWT Bearer tokens** for authentication.

        1. Login via `/api/v1/auth/login` to obtain tokens
        2. Include the access token in the `Authorization` header: `Bearer <access_token>`
        3. Refresh expired tokens via `/api/v1/auth/refresh-token`

        ## Versioning
        The API uses URL path versioning (e.g., `/api/v1/`, `/api/v2/`).
        Current version: **v1**
        
  contact:
    name: API Support
    email: support@capemedia.co.ke
  license:
    name: Cape Media
servers:
  - url: https://api.diginacape.co.ke/acl
    description: Production
  - url: http://localhost:8000
    description: Local
security: []
paths:
  /api/v1/auth/login:
    post:
      tags:
        - Authentication
      summary: Login with username and password
      description: |-
        Authenticate user and obtain access tokens.

        This endpoint authenticates a user with Keycloak and returns
        JWT access and refresh tokens for API access.
      operationId: auth_login
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/LoginRequest'
            examples:
              Login:
                value:
                  username: john.doe@capemedia.co.ke
                  password: secret
                  realm: capemedia
          application/x-www-form-urlencoded:
            schema:
              $ref: '#/components/schemas/LoginRequest'
          multipart/form-data:
            schema:
              $ref: '#/components/schemas/LoginRequest'
        required: true
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/VerifyOTP'
              examples:
                VerifyOTPResponse:
                  value:
                    status: success
                    message: OTP verified successfully
                    data:
                      access_token: eyJ...
                      refresh_token: eyJ...
                      expires_in: 300
                  summary: Verify OTP response
          description: ''
      security:
        - bearerAuth: []
        - {}
components:
  schemas:
    LoginRequest:
      type: object
      properties:
        username:
          type: string
          minLength: 1
          description: Username or email
        password:
          type: string
          minLength: 1
          description: Password
        realm:
          type: string
          minLength: 1
          default: capemedia
          description: >-
            Keycloak realm name (e.g. 'capemedia', 'capedigi'). Defaults to
            primary realm.
      required:
        - password
        - username
    VerifyOTP:
      type: object
      properties:
        username:
          type: string
          description: Username or email
        password:
          type: string
          description: Password
        realm:
          type: string
          default: capemedia
          description: >-
            Keycloak realm name (e.g. 'capemedia', 'capedigi'). Defaults to
            primary realm.
        otp:
          type: string
          description: OTP
      required:
        - otp
        - password
        - username
  securitySchemes:
    bearerAuth:
      type: http
      scheme: bearer
      bearerFormat: JWT
      description: 'Enter your JWT token in the format: Bearer <token>'

````