> ## Documentation Index
> Fetch the complete documentation index at: https://tapcoupon.mintlify.site/llms.txt
> Use this file to discover all available pages before exploring further.

# Employee login

> Validate employee credentials and create a session token.

## POST `/employee/login`

Validate employee credentials and create a session token.

Send `Authorization: Bearer YOUR_API_KEY` and `X-Device-ID: YOUR_DEVICE_ID`. See [authentication](https://tapcoupon.mintlify.site/authentication.md).

Use the returned `token` as `X-Employee-Token` on employee-protected requests. `sessionExpiresAt` gives the expiration time; sessions currently last 24 hours.

Non-admin employees must be assigned to the API key's location. An empty `locationIds` array grants no location access. `isAdmin: true` bypasses this location assignment check. `accessHistory` and `deleteScanHistory` describe history permissions.

This endpoint has an additional limit of 20 requests per minute per IP.

### Example request

```bash theme={null}
curl -X POST "https://tapcoupon.at/api/v1/employee/login" \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -H "X-Device-ID: YOUR_DEVICE_ID" \
  -H "Content-Type: application/json" \
  -d '{
  "username": "Cashier",
  "password": "YOUR_EMPLOYEE_PASSWORD"
}'
```

### Example response

```json theme={null}
{
  "employee": {
    "id": "693869428d49e641ba110e17",
    "username": "Cashier",
    "isAdmin": false,
    "accessHistory": false,
    "deleteScanHistory": false,
    "locationIds": [
      "693869428d49e641ba110e18"
    ],
    "clientId": "693869428d49e641ba110e19",
    "activeUserAgentName": ""
  },
  "message": "Login successful",
  "token": "YOUR_EMPLOYEE_TOKEN",
  "sessionExpiresAt": "2026-10-03T12:00:00Z"
}
```


## OpenAPI

````yaml api-reference/openapi.json POST /employee/login
openapi: 3.1.0
info:
  title: TapCoupon POS and partner API
  version: 1.0.0
  description: >-
    API-key POS operations, customer card views, and partner payment sessions.
    Verified against the tap_coupon backend on 2026-10-02. Dashboard /clients
    and administrative routes use separate authentication and are outside this
    reference.
servers:
  - url: https://tapcoupon.at/api/v1
security: []
paths:
  /employee/login:
    post:
      tags:
        - Employees
      summary: Employee login
      description: Validate employee credentials and create a session token.
      operationId: employees_login
      parameters:
        - name: X-Device-ID
          in: header
          required: true
          description: Stable device identifier. API key binds to this value on first use.
          schema:
            type: string
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/Credentials'
            example:
              username: Cashier
              password: YOUR_EMPLOYEE_PASSWORD
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/EmployeeLogin'
              example:
                employee:
                  id: 693869428d49e641ba110e17
                  username: Cashier
                  isAdmin: false
                  accessHistory: false
                  deleteScanHistory: false
                  locationIds:
                    - 693869428d49e641ba110e18
                  clientId: 693869428d49e641ba110e19
                  activeUserAgentName: ''
                message: Login successful
                token: YOUR_EMPLOYEE_TOKEN
                sessionExpiresAt: '2026-10-03T12:00:00Z'
        '400':
          description: Invalid request, card type, balance, points, or location.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '401':
          description: >-
            Missing or invalid API key, device id, employee token, or
            credentials.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '403':
          description: >-
            Device binding mismatch, archived location, employee location
            restriction, or account restriction.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '429':
          description: >-
            Rate limit exceeded. The response body is determined by the
            rate-limit middleware.
        '500':
          description: Internal server error.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
      security:
        - bearerAuth: []
components:
  schemas:
    Credentials:
      type: object
      properties:
        username:
          type: string
        password:
          type: string
      required:
        - username
        - password
    EmployeeLogin:
      type: object
      properties:
        employee:
          $ref: '#/components/schemas/Employee'
        token:
          type: string
        sessionExpiresAt:
          type: string
          format: date-time
        message:
          type: string
      required:
        - employee
        - token
        - sessionExpiresAt
        - message
    Error:
      type: object
      properties:
        error:
          type: string
          description: Human-readable error.
        errorCode:
          type: string
          description: >-
            Handler errors include a machine-readable code; middleware errors
            may omit it.
      required:
        - error
    Employee:
      type: object
      properties:
        id:
          type: string
          description: MongoDB object id.
          pattern: ^[a-fA-F0-9]{24}$
        username:
          type: string
        isAdmin:
          type: boolean
        accessHistory:
          type: boolean
        deleteScanHistory:
          type: boolean
        locationIds:
          type: array
          items:
            type: string
            description: MongoDB object id.
            pattern: ^[a-fA-F0-9]{24}$
        clientId:
          type: string
          description: MongoDB object id.
          pattern: ^[a-fA-F0-9]{24}$
        createdAt:
          type: string
          format: date-time
        updatedAt:
          type: string
          format: date-time
        activeUserAgentName:
          type: string
  securitySchemes:
    bearerAuth:
      type: http
      scheme: bearer
      description: Location API key. Also requires X-Device-ID.

````

This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.