> ## Documentation Index
> Fetch the complete documentation index at: https://docs.hi-doctor.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Sign in

> Exchange an email and password for an `access` and `refresh` token pair.

Requires the `X-Brand-Slug: hi-doctor` header. Sign-in itself needs no bearer token.

An account created through Google sign-in has no password and is refused with `code: "google_account"` — offer *Continue with Google* rather than an invalid-credentials message, which reads to the patient as though their account is gone.



## OpenAPI

````yaml /api-reference/openapi.json post /v1/users/token/
openapi: 3.0.3
info:
  title: Hi-Doctor API
  version: 1.0.0
  description: >-
    Patient-facing REST API for Hi-Doctor.


    Authenticate with email and password to receive a JWT pair, then send the
    access token as `Authorization: Bearer <token>` on every subsequent request.


    Only patient-accessible endpoints are documented here. Clinician and
    back-office endpoints are intentionally omitted.
  contact:
    name: Hi-Doctor
    email: hello@hi-doctor.ai
    url: https://hi-doctor.ai
servers:
  - url: https://api.hi-doctor.ai
    description: Production
security:
  - bearerAuth: []
tags:
  - name: Account
    description: Registration, email verification, sign-in and profile.
  - name: Questionnaires
    description: Complete a consultation questionnaire and submit it for medical review.
  - name: Consultations
    description: Consultations a doctor has reviewed or is reviewing.
  - name: Prescriptions
    description: Prescriptions and reissue requests.
  - name: Billing
    description: Checkout, subscription management and the Stripe billing portal.
  - name: Records
    description: Orders, invoices and side-effect reports.
  - name: Messages
    description: The patient's private thread with their medical team.
  - name: Progress
    description: Weight, injection and note tracking. Requires an active treatment plan.
  - name: Referrals
    description: Referral summary and transactions.
paths:
  /v1/users/token/:
    post:
      tags:
        - Account
      summary: Sign in
      description: >-
        Exchange an email and password for an `access` and `refresh` token pair.


        Requires the `X-Brand-Slug: hi-doctor` header. Sign-in itself needs no
        bearer token.


        An account created through Google sign-in has no password and is refused
        with `code: "google_account"` — offer *Continue with Google* rather than
        an invalid-credentials message, which reads to the patient as though
        their account is gone.
      operationId: users_token_create
      parameters:
        - in: header
          name: X-Brand-Slug
          required: true
          schema:
            type: string
            enum:
              - hi-doctor
            default: hi-doctor
          description: >-
            Identifies the Hi-Doctor brand. Required; the request is rejected
            without it.
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/CustomTokenObtainPair'
            example:
              email: patient@example.com
              password: a-strong-password
        required: true
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/SignInResult'
              example:
                access: >-
                  eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJ0b2tlbl90eXBlIjoiYWNjZXNzIn0.Ksn1w0K6iQ
                refresh: >-
                  eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJ0b2tlbl90eXBlIjoicmVmcmVzaCJ9.9Xb2mQ4dLo
          description: ''
        '400':
          description: The account was created with Google sign-in and has no password.
          content:
            application/json:
              example:
                error: This account uses Google sign-in
                code: google_account
        '401':
          description: >-
            Wrong email or password, the account is unverified, or X-Brand-Slug
            was omitted.
          content:
            application/json:
              example:
                error: Invalid credentials
                code: invalid_credentials
        '403':
          description: The account is disabled.
          content:
            application/json:
              example:
                error: This account is inactive
                code: user_inactive
      security: []
components:
  schemas:
    CustomTokenObtainPair:
      type: object
      description: >-
        Email and password sign-in, returning an `access` and `refresh` token
        pair.


        Requires the `X-Brand-Slug: hi-doctor` header. An account created
        through Google sign-in has no password and is refused with `code:
        "google_account"`.
      properties:
        email:
          type: string
          writeOnly: true
        password:
          type: string
          writeOnly: true
      required:
        - email
        - password
    SignInResult:
      type: object
      description: >-
        Token pair returned by sign-in, with the role flags the web app uses for
        routing. All three are `false` on a patient account and none of them
        grants access to anything in this reference.
      required:
        - access
        - refresh
      properties:
        refresh:
          type: string
          description: Refresh token.
        access:
          type: string
          description: 'Access token — send as `Authorization: Bearer`.'
        is_doctor:
          type: boolean
        is_backoffice_admin:
          type: boolean
        is_marketer:
          type: boolean
  securitySchemes:
    bearerAuth:
      type: http
      scheme: bearer
      bearerFormat: JWT
      description: Access token from POST /v1/users/token/

````