Ana içeriğe geç

Log in for a native / mobile device (bearer token)

POST 
/api/auth/device

Bearer-token login for native / mobile (Capacitor) clients (Faz 0 / Dilim 1). PUBLIC and SESSIONLESS: no cookie, no CSRF. Authenticates the GLOBAL account exactly like /api/login (same credentials, same generic failure, same throttle) but issues a Sanctum personal access token instead of a session, with the issuing tenant pinned on the token.

  • Exactly one active membership → returns a token for that tenant.
  • More than one active membership AND no tenant_id → returns needs_tenant_selection: true + memberships (no token); the client shows a picker and re-calls with a chosen tenant_id.
  • More than one with a valid tenant_id → returns a token for that tenant.
  • A tenant_id the account is not an active member of → 422.

The plaintext token is returned ONCE. Tokens are long-lived and revoked via /api/me/devices; abilities are ['*'] for now (refresh-token rotation + scoped abilities are later refinements).

Request​

Responses​

Either a token (membership resolved) or a tenant-selection request (multiple memberships, no tenant_id; no token issued).