> ## Documentation Index
> Fetch the complete documentation index at: https://docs.4casters.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

> Log in and authorize requests

To use any authenticated route you need an auth token. Tokens are obtained by logging in and are valid for **30 days**, after which a fresh login is required.

## Log in

`POST /user/login`

<CodeGroup>
  ```bash curl theme={null}
  curl -X POST https://api.4casters.io/user/login \
    -H "Content-Type: application/json" \
    -d '{"username": "your_username", "password": "your_password"}'
  ```

  ```json JSON body theme={null}
  {
    "username": "your_username",
    "password": "your_password"
  }
  ```
</CodeGroup>

### Request

<ParamField body="username" type="string" required>Account username (or email).</ParamField>
<ParamField body="password" type="string" required>Account password.</ParamField>

### Response

The token is returned both as `data.user.auth` **and** as a signed `auth` cookie (`Set-Cookie`). For most server-side integrations you'll want to capture `data.user.auth` and discard the cookie.

```json theme={null}
{
  "data": {
    "user": {
      "id": "5fe37acbb5a23600123662c1",
      "username": "your_username",
      "auth": "5cd551d6...",
      "type": "p2p",
      "oddsFormat": "american",
      "displayBalance": 1250.50,
      "creditLimit": 500,
      "liability": -125.00,
      "commissionCharged": 0.01,
      "hasMarketMakerAccess": false,
      "isPro": false,
      "createdAt": "2020-12-23T17:14:09.000Z"
    }
  }
}
```

See [`User`](/api-reference/openapi.json) in the OpenAPI schema for every field.

### Error responses

| Status | Meaning                                 |
| ------ | --------------------------------------- |
| `400`  | `username` and `password` are required. |
| `401`  | Username or password is incorrect.      |
| `403`  | Account banned, locked, or closed.      |
| `429`  | Login rate-limit exceeded.              |

## Authorizing requests

Pass the token from `data.user.auth` on every subsequent request. Three header / payload formats are accepted, in this order of preference:

<Tabs>
  <Tab title="Authorization header (recommended)">
    ```bash theme={null}
    curl https://api.4casters.io/user/getMe \
      -H "Authorization: Bearer 5cd551d6..."
    ```

    The `Bearer ` prefix is optional — passing the bare token also works.
  </Tab>

  <Tab title="Cookie">
    The signed `auth` cookie set by `/user/login` is honored automatically on every endpoint when reused on the same client.
  </Tab>

  <Tab title="Body field (POST only)">
    ```json theme={null}
    { "token": "5cd551d6...", "...": "..." }
    ```

    Provided as a fallback for clients that can't easily set custom headers (e.g. some webhook senders).
  </Tab>
</Tabs>

If no token is provided — or the token is unknown / expired — the server responds with `401 InvalidCredentials`.

## Token rotation

Authenticated requests with tokens older than 30 days automatically rotate to a new token. When this happens, the new token is returned in the `X-Auth-Token` response header (and as an updated signed `auth` cookie). Long-lived integrations should watch for this header and persist the new value.

## Logging out

`POST /user/logout` invalidates the current token. Subsequent requests with that token return `401`.


## OpenAPI

````yaml POST /user/login
openapi: 3.1.0
info:
  title: 4casters REST API
  version: 1.0.0
  description: >-
    Public REST API for the 4casters peer-to-peer betting exchange. Use this API
    to manage your account, query the orderbook and games, and place / edit /
    cancel orders.


    All responses (unless noted otherwise) are JSON envelopes of the form `{
    "data": ... }`.
  contact:
    name: 4casters
    url: https://4casters.io
servers:
  - url: https://api.4casters.io
    description: Production
security:
  - bearerAuth: []
tags:
  - name: Authentication
    description: Login and account session management
  - name: User
    description: Read account info, bets, and orders
  - name: Orders
    description: Place, edit, look up, and cancel orders
  - name: Markets
    description: Browse leagues, games, participants, and orderbooks
  - name: Affiliate
    description: Affiliate / referral commission
paths:
  /user/login:
    post:
      tags:
        - Authentication
      summary: Log in
      description: >-
        Initialize a session and obtain an auth token. Auth tokens are valid for
        30 days, after which a fresh login is required. The token returned here
        can also be used to authenticate against the 4casters Streaming
        WebSocket API.
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/LoginRequest'
            example:
              username: your_username
              password: your_password
      responses:
        '200':
          description: >-
            Login successful. The auth token is returned both as
            `data.user.auth` and as a signed `auth` cookie.
          content:
            application/json:
              schema:
                type: object
                properties:
                  data:
                    type: object
                    properties:
                      user:
                        $ref: '#/components/schemas/AuthenticatedUser'
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          description: Username or password is incorrect
        '403':
          description: Account banned, locked, or closed
      security: []
components:
  schemas:
    LoginRequest:
      type: object
      required:
        - username
        - password
      properties:
        username:
          type: string
        password:
          type: string
          format: password
    AuthenticatedUser:
      allOf:
        - $ref: '#/components/schemas/User'
        - type: object
          properties:
            auth:
              type: string
              description: >-
                Auth token. Pass as `Authorization: Bearer <auth>` on subsequent
                requests.
            email:
              type: string
              format: email
            passwordSecurityChecks:
              type: object
              description: Result of password strength checks.
    User:
      type: object
      properties:
        id:
          type: string
          description: User id.
        username:
          type: string
        type:
          $ref: '#/components/schemas/UserType'
        oddsFormat:
          $ref: '#/components/schemas/OddsFormat'
        displayBalance:
          type: number
          description: Current balance (display value).
        creditLimit:
          type: number
          description: Credit limit (negative for credit accounts).
        liability:
          type: number
          description: Current open liability across all games.
        commissionCharged:
          type: number
          description: Commission rate charged to this account.
        maxLiability:
          type: number
          description: Account-level cap on liability.
        matchedVolume:
          type: object
          description: Account preferences for displaying matched volume.
        openInterest:
          type: object
          description: Account preferences for displaying open interest.
        isAdmin:
          type: boolean
        hasMarketMakerAccess:
          type: boolean
        isPro:
          type: boolean
        isDeposit:
          type: boolean
        isAlphaUser:
          type: boolean
        sportsbookDefault:
          type: boolean
        defaultRotationNumbers:
          type: boolean
        displayRotationNumbers:
          type: boolean
        viewOddsWithCommission:
          type: boolean
        defaultExpiry:
          type: integer
          nullable: true
          description: Default order expiry, in minutes.
        defaultOffer:
          type: number
          nullable: true
          description: Default offer size when placing orders.
        defaultSendOrderMessage:
          type: boolean
        sportsbookMinimumDisplay:
          type: number
        showChatLastMessage:
          type: boolean
        yesNoSummary:
          type: boolean
        accessCode:
          type: string
          nullable: true
        code:
          type: string
          nullable: true
        p2pCode:
          type: string
          nullable: true
        createdAt:
          type: string
          format: date-time
        emailConfirmation:
          type: boolean
    HttpError:
      type: object
      properties:
        error:
          type: string
          description: Human-readable error message.
    UserType:
      type: string
      enum:
        - free
        - p2p
        - marketmaker
        - agent
      description: Account type.
    OddsFormat:
      type: string
      enum:
        - american
        - decimal
  responses:
    BadRequest:
      description: Bad request
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/HttpError'
  securitySchemes:
    bearerAuth:
      type: http
      scheme: bearer
      description: >-
        Pass your auth token in the `Authorization` header. The `Bearer` prefix
        is optional; the server also accepts a signed `auth` cookie or a `token`
        field in the request body.

````