# Quickstart

<small>Written by Rohman Beny Riyanto</small>

The shortest path from "never touched this API" to "made an authenticated
call and got real data back." Every step below can be done two ways:
copy-pasting the `curl` command, or clicking through the same request in
this site's own **Try It** panel (the button on each endpoint's
[API Reference](/api/auth) page) - both hit the exact same server, so pick
whichever is faster for you.

## 1. Get an account

If you already have credentials, skip to step 2. Otherwise, register a
customer account:

```bash
curl -X POST 'https://api.laksonoteknologi.com/v2/customer/register' \
  -H 'Content-Type: application/json' \
  -d '{
    "command": "register-customer",
    "data": {
      "name": "Jane Doe",
      "email": "jane@example.com",
      "password": "at-least-8-chars",
      "password_confirmation": "at-least-8-chars"
    }
  }'
```

This does **not** log you in automatically - registration and login are
separate steps on purpose (see [Unified Login](/api/auth#unified-login)'s
own description). Move on to step 2 with the same email/password.

## 2. Log in and get a token

```bash
curl -X POST 'https://api.laksonoteknologi.com/v2/auth/login' \
  -H 'Content-Type: application/json' \
  -d '{
    "command": "unified-login",
    "data": { "email": "jane@example.com", "password": "at-least-8-chars" }
  }'
```

The response bundles everything a typical app needs on first load in one
call:

```json
{
  "response_code": "001",
  "response_text": "Success",
  "data": {
    "access_token": "eyJ...",
    "refresh_token": "eyJ...",
    "expires_in": 3600,
    "user": { "id": "...", "parent_role": "customer", "sub_role": null, "is_root": false, "merchant_id": null },
    "permissions": ["..."]
  }
}
```

Same endpoint works for `system_owner`, `merchant`, and `customer`
accounts - you never send which kind of account you're logging in as, the
server figures it out from the email.

## 3. Call an authenticated endpoint

Every endpoint tagged **Auth required** on the [API Reference](/api/auth)
pages needs `access_token` from step 2 as a Bearer token:

```bash
curl 'https://api.laksonoteknologi.com/v2/admin/permissions/catalog' \
  -H 'Authorization: Bearer eyJ...'
```

`access_token` expires after `expires_in` seconds (see the response
above). When it does, don't send the user back to login - exchange the
`refresh_token` for a new pair first (see
[FE Auth Error Handling](/guide/auth-error-handling) for exactly which
response code means "expired, go refresh" vs. "actually logged out, go to
login").

## Where to go next

- **[FE Auth Error Handling](/guide/auth-error-handling)** - the 4 distinct
  ways an authenticated call can fail, and what to do for each.
- **[Rate Limiting](/guide/rate-limiting)** - what happens past 100
  requests/minute and how to back off.
- **[Validation Errors](/guide/validation-errors)** - the shape of a
  rejected request and how it differs from an auth error.
- **[Export to Postman](/guide/postman-export)** - skip typing `curl`
  commands entirely; download every endpoint as a ready-to-run Postman
  collection.
- **[Request/Response Pattern](/reference/cqrs-framework)** - why every
  request body looks like `{"command"/"query": "...", "data": {...}}`,
  and how auth/permission checks are ordered.