Authentication

POST /auth/login

Creates a Partner JWT valid for 12 hours. Share one token across backend workers and reuse it until shortly before its exp time. Allow only one login in flight per account.

On an authenticated endpoint’s 401, renew once and retry once; stop if it still fails. A login 401 means the credentials are wrong or API access is not enabled for the account; correct the credentials or ask Clutch to enable access before trying again. A 403 requires checking permissions. For login 429, wait for Retry-After seconds across all workers. For login 503 or a network failure, use exponential backoff with jitter, starting at one second, capped at 30 seconds, with at most three retries. Other writes follow their endpoint’s retry rules.

Body:

{
  "email": "partner@example.com",
  "password": "<partner-password>"
}

Sample response

{
  "data": {
    "id": "dd2dfc8c-4244-4a6e-b410-eec76f9254c0",
    "token": "<partner-jwt>"
  }
}