API Reference
Login Client
Overview
Authenticate an existing client to access protected RealtimeX APIs.
Use this endpoint to verify the client's credentials and obtain a new Access Token and Refresh Token. These tokens are required to authenticate future API requests and maintain a secure session.
When to use this endpoint?
Use Login Client when:
- Signing in an existing client.
- Starting a new authenticated session.
- The client already has a registered account.
- New authentication tokens are required.
If you don't have a client account yet, register one first using Auth → Register Client.
POST
{baseUrl}/api/{apiVersion}/auth/jwt/client/loginAuthentication
Not required
Tenant-scoped
No (root DB)
Request Headers
| Header | Value | Description |
|---|---|---|
| Content-Type | application/json | Specifies the content type of the request body. |
| is-tenant | false | Targets the tenant DB ("true", needs x-client-id) or the root DB ("false", e.g. client register/create). |
Request Payload
json
{
"email": "cilentpro1@yopmail.com",
"password": "clientpro1"
}| Field | Type | Required | Description |
|---|---|---|---|
| string | The email address of the client to authenticate. | ||
| password | string | The password for the client's account. |
Success Response (HTTP 200 OK)
json
{
"success": true,
"message": "Login successfully",
"data": {
"client": {
"_id": "699fe1377846dcfb775c645c",
"name": "client pro 1",
"email": "cilentpro1@yoopmail.com",
"slug": "client-pro-1",
"isActive": true,
"createdAt": "2026-02-26T05:59:19.339Z",
"updatedAt": "2026-02-26T05:59:20.031Z"
},
"accessToken": "<access_token>",
"refreshToken": "<refresh_token>"
},
"error": null
}After a Successful Login
Store the returned credentials securely.
- Access Token — Include in the Authorization header for all protected API requests.
- Refresh Token — Use to request a new access token when the current one expires.
- Client ID — Include as the x-client-id header when accessing tenant-scoped resources.
http
Authorization: Bearer <access_token>
is-tenant: true
x-client-id: <client_id>
Content-Type: application/json
Common Errors
| Code | Reason |
|---|---|
| 400 Bad Request | Required fields are missing or invalid. |
| 401 Unauthorized | Invalid email or password. |
| 403 Forbidden | Client account is inactive or access is restricted. |
| 429 Too Many Requests | Too many login attempts. Please try again later. |
| 500 Internal Server Error | An unexpected error occurred while processing the request. |
Best Practices
- Always use HTTPS when sending authentication requests.
- Store tokens securely and never expose them in client-side source code.
- Replace expired access tokens using the Refresh Token endpoint instead of asking users to log in again.
- Never share or log authentication tokens in production environments.
What's Next
After successfully logging in, you can:
- Call protected RealtimeX API endpoints.
- Access tenant-specific resources using your Client ID.
- Authenticate end users using User → Login Client User for Conversations, Messages, and other user-level operations.