Validate JWT and issue session token

POST

http://os-992244000006.local/api/v1/auth/login

Validates JWT from auth server and issues session token.

JWT Validation (security-critical order):

Signature verification (ECDSA P-256)
Audience check (must match device serial number)
POH expiration check (exp_poh vs current POH)
Nonce validation (single-use, must be pending)

Token Usage Types:

cookie: Sets HTTP-only cookie, returns success message
bearer: Returns session token in body, no cookie set

Security Properties:

All validation failures return HTTP 401 with no information leakage
Nonce marked as used after successful validation
Session tokens expire based on POH, not wall-clock time
Cookie security: http_only=True, same_site='Strict', secure=True (HTTPS)

Validates JWT from auth server and issues session token. **JWT Validation (security-critical order):** 1. Signature verification (ECDSA P-256) 2. Audience check (must match device serial number) 3. POH expiration check (`exp_poh` vs current POH) 4. Nonce validation (single-use, must be pending) **Token Usage Types:** - `cookie`: Sets HTTP-only cookie, returns success message - `bearer`: Returns session token in body, no cookie set **Security Properties:** - All validation failures return HTTP 401 with no information leakage - Nonce marked as used after successful validation - Session tokens expire based on POH, not wall-clock time - Cookie security: `http_only=True`, `same_site='Strict'`, `secure=True` (HTTPS)

$	curl -X POST http://os-992244000006.local/api/v1/auth/login \
>	-H "Content-Type: application/json" \
>	-d '{
>	"token": "eyJhbGciOiJFUzI1NiIsInR5cCI6IkpXVCJ9...",
>	"token_usage": "cookie"
>	}'

Request

Response

Errors