Direct sign-in

The direct sign-in endpoint exists for the SplashMe web application and for bootstrapping: it is how you obtain a first token to register an OAuth client. It issues an access token identical to the one the OAuth token endpoint issues, but without a refresh token.

Third-party products that sign other people in must use the OAuth2 flow so that users never type their SplashMe password into your software.

POST/api-gateway/v1/auth/login

{ "email": "you@example.com", "password": "your-password" }

{
  "status": "SUCCESS",
  "data": {
    "token": "eyJhbGciOiJIUzI1NiIs...",
    "user": {
      "email": "you@example.com",
      "firstName": "Sam",
      "lastName": "Lee",
      "userType": "owner",
      "userId": "aB3dE5fG7h"
    }
  }
}

The response also carries a currentDevice object describing the controller last selected in the SplashMe app; it is not needed for API use.

Signing in also refreshes the server’s copy of the account’s sites and controllers, which is what the ownership check on device endpoints relies on.

Status	message
400	Email and password are required
401	Invalid credentials
429	Too many attempts, please try again later, with Retry-After: 60. Limit is 10 attempts per minute per IP address.