Log In Visitor

Signs a visitor in with email and password and returns an access token and a refresh token. Use the access token to call the visitor endpoints.

POST/v1/auth/login

Authentication

Public key?key=pk_…

Public key in the `key` query parameter. No OAuth, no secret.

Edge cache: no-store

Query Parameters

keystring

required

The site's public key (pk_…). It selects the account. Safe to ship to the browser.

Body Parameters

emailstring

required

The email the visitor registered with.

passwordstring

required

The visitor's password (up to 20 characters).

Responses

200Success

application/json

titlestring

hideToastboolean

typestring

variantstring

messagestring

accessTokenstring

refreshTokenstring

expiresInnumber

Errors

401Wrong email or password (`message: "Invalid credentials"`, the same answer for an unknown email), a body that fails validation, or a missing or invalid public key. Error bodies have `type: "error"`, `message` and an inner `status`.

403The Panda account is not active. The body also carries `code: "TENANT_INACTIVE"`.

Notes

Visitors only sign in to the site whose key you send; an account on another Panda site does not work here.
A successful login is added to the contact's activity feed in the owner's CRM.
Tokens: `accessToken` lasts 1 hour (`expiresIn` is in seconds). `refreshToken` lasts 60 days and renews every time you refresh. Send the access token as `Authorization: Bearer`, never as a cookie.

Request

curl --request POST \
  --url "https://api.pandaidx.com/v1/auth/login?key={{public_key}}" \
  --header "Content-Type: application/json" \
  --data '{"email":"alex.example@example.com","password":"ChangeMe-Example-1"}'

Response200 OK

{
  "title": "User Logged In",
  "hideToast": false,
  "type": "success",
  "variant": "default",
  "message": "User Logged In",
  "accessToken": "v1.example-access-token",
  "refreshToken": "example-refresh-token",
  "expiresIn": 3600
}