Log in
tenantKeyX-Tenant-Key<token>The public store key (pk_live_…). Required on every call.
X-Client-IP?stringOptional. IP address of the shopper (one IPv4/IPv6, no port, no list). Honoured only together with a valid X-Tenant-Secret; ignored otherwise. Used for rate limits and recorded with form submissions.
X-Tenant-Secret?stringOptional here. Server secret of the store: server-to-server only, never from a browser. Enables X-Client-IP.
X-Session-Id?stringOptional. The shopper's sid cookie value (8-128 of letters, digits, . _ : -). Links the choice made in this browser to the customer, so a later change on another device reaches it, and decides whether the login event is kept and the visitor linked to the customer. Read for this request only, compared as a SHA-256 hash, never stored raw. Send it on every write; a malformed value is ignored (never a 422), and leaving it out means "no choice known".
X-Visitor-Id?stringOptional. The vid cookie value, when the shopper has one. Links the choice made in this browser to the customer, so a later change on another device reaches it, and decides whether the login event is kept and the visitor linked to the customer. Read for this request only, compared as a SHA-256 hash, never stored raw. Send it on every write; a malformed value is ignored (never a 422), and leaving it out means "no choice known".
X-Consent-Token?stringOptional. The consent cookie value (the consent_token from PUT consent). Links the choice made in this browser to the customer, so a later change on another device reaches it, and decides whether the login event is kept and the visitor linked to the customer. Read for this request only, compared as a SHA-256 hash, never stored raw. Send it on every write; a malformed value is ignored (never a 422), and leaving it out means "no choice known".
application/json- body
email*stringemailpassword*stringSuccess.
application/json- response
data*curl -X POST 'https://api.elaraone.app/api/v1/auth/login' \ -H 'X-Tenant-Key: pk_live_…' \ -H 'X-Tenant-Secret: your-server-secret' \ -H 'Content-Type: application/json' \ -d '{ "email": "[email protected]", "password": "string"}'{ "data": { "user": { "id": 0, "name": "string", "email": "string", "email_verified_at": "string", "customer_id": 0 }, "token": "string", "expires_at": "string" }}