Authentication

Use this to obtain a JWT for all documented routes that require Connected + API.

POST /user/login

Exchanges an API key for a JWT used on subsequent calls.

POST https://api.mannco.store/user/login

Authentication: none (you send the key in the body).

Request body

The router accepts JSON (Content-Type: application/json) or application/x-www-form-urlencoded. Required field:

apiKey

string

required

API key from your Mannco.store account settings.

JSON example

{ "apiKey": "your-api-key" }

Form example

apiKey=your-api-key

Success response

{
  "err": false,
  "success": true,
  "content": {
    "jwt": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9..."
  }
}

Use content.jwt (there is no data wrapper).

JWT claims (decoded payload)

Claim	Type	Description
`iss`	string	Always `"API"`
`sub`	string	User Steam64 ID
`exp`	number	Expiry (Unix), about 31 days after issue
`iat`	number	Issued-at (Unix)
`jti`	string	Token id
`ip`	string	Client IP at login time
`proxy`	boolean	Proxy context
`API`	boolean	Always `true` for this flow
`country`	string	ISO country code
`steamid`	string	Steam ID (backend format)
`roles` / `rolesHash`		Role data

Errors (loginAPI.php)

Response type	Typical HTTP	content
`error`	300	Missing required parameter: apiKey
`forbidden`	403	Invalid API key
`forbidden`	403	Country blocked

Examples

cURL

curl -X POST https://api.mannco.store/user/login \
  -H "Content-Type: application/json" \
  -d '{"apiKey":"your-api-key"}'

JavaScript

const res = await fetch("https://api.mannco.store/user/login", {
  method: "POST",
  headers: { "Content-Type": "application/json" },
  body: JSON.stringify({ apiKey: "your-api-key" }),
});
const data = await res.json();
const jwt = data.content.jwt;

Python

import requests

r = requests.post(
    "https://api.mannco.store/user/login",
    json={"apiKey": "your-api-key"},
)
data = r.json()
jwt = data["content"]["jwt"]

Store the JWT securely. When it expires, call POST /user/login again with your API key.

Using the JWT

For endpoints that require Connected + API, send:

Authorization: Bearer <jwt>

The server may also accept a session cookie in browser contexts; for API clients, Bearer is the intended method.

IP binding

The JWT is tied to the IP address at login. If your client IP changes (VPN, mobile network, proxy), requests may fail authentication. Use a stable egress IP or the same network as when you obtained the token.

Routes without a logged-in user

Some routes only have the api filter (no connected). Public item endpoints may work without a Bearer token. GET /user/store/ does not require a user JWT. For your account data, always send the Bearer token from POST /user/login.

2FA vs API JWT

Server routes marked with 2fa accept a JWT from POST /user/login without sending a 2FA header: requires2FA succeeds when isAPI is true. If you use a web session instead of the API JWT, 2FA rules apply as on the website.

Overview

Brand

Authentication

POST /user/login

Request body

JSON example

Form example

Success response

JWT claims (decoded payload)

Errors (loginAPI.php)

Examples

Using the JWT

IP binding

Routes without a logged-in user

2FA vs API JWT

​API login (POST /user/login)

POST /user/login

​Request body

​JSON example

​Form example

​Success response

​JWT claims (decoded payload)

​Errors (loginAPI.php)

​Examples

​Using the JWT

​IP binding

​Routes without a logged-in user

​2FA vs API JWT

API login (`POST /user/login`)

Request body

JSON example

Form example

Success response

JWT claims (decoded payload)

Errors (loginAPI.php)

Examples

Using the JWT

IP binding

Routes without a logged-in user

2FA vs API JWT