> ## Documentation Index
> Fetch the complete documentation index at: https://docs.errorgolf.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Get Your Access Token

> ## Login and Authentication

Exchange your email and password for a JWT token. It's like a backstage pass but for APIs.

**Security features:**
- Rate limiting prevents brute force (10 attempts then timeout)
- Case-insensitive emails (we're reasonable people)
- Tokens expire after 1 week (nothing good lasts forever)

**Token usage:**
- Include in Authorization header: `Bearer <token>`
- Refresh before expiry or start the login dance again




## OpenAPI

````yaml POST /token
openapi: 3.0.3
info:
  title: Error Golf API - Where Code Goes to Die
  description: >
    # 🏌️ Error Golf API


    **Error Golf** replaces algorithmic tests with creative coding challenges
    that actually measure problem-solving skills.

    Companies pay $39 per candidate to discover if applicants can think
    creatively or just copy-paste from Stack Overflow.


    ## Business Model

    - **Setup Fee:** $49 one-time fee (because quality costs money)

    - **Per Candidate:** $39 each attempt (cheaper than a decent lunch)

    - **No Subscriptions:** We're not Netflix


    ## Golf Terminology

    - **Round:** Complete test (3 questions, like actual golf but with more
    crying)

    - **Hole:** Individual question (candidates pick 3 from 100 nightmares)

    - **Shot:** Solution attempt (usually involves existential crisis)

    - **Scorecard:** A roast of your code from 3 different personalities


    ## Authentication

    Protected endpoints need JWT Bearer token: `Bearer <your-digital-passport>`


    ## Error Responses

    When things inevitably break:

    ```json

    {
      "error": "something_went_sideways",
      "message": "A helpful explanation of what you did wrong this time"
    }

    ```


    ## Rate Limiting

    - 100 requests/hour (generous, considering your coding skills)

    - Headers tell you when we'll start ignoring you
  version: 1.0.0
  contact:
    name: Error Golf Support (May the odds be ever in your favor)
    url: https://errorgolf.com/support
    email: support@errorgolf.com
  license:
    name: Proprietary (We own this beautiful mess)
    url: https://errorgolf.com/terms
servers:
  - url: https://api.errorgolf.com/v1
    description: Production (where dreams meet reality)
  - url: http://localhost:8080/v1
    description: Local dev (your personal playground)
security: []
tags:
  - name: Health
    description: Is this thing even working?
  - name: Course
    description: Browse the vault of coding nightmares
  - name: Round
    description: Take 3 swings at holes you pick
  - name: Members
    description: Prove you belong here
  - name: Clubhouse
    description: Configure your coding challenge empire
paths:
  /token:
    post:
      tags:
        - Members
      summary: Get your access pass
      description: >
        ## Login and Authentication


        Exchange your email and password for a JWT token. It's like a backstage
        pass but for APIs.


        **Security features:**

        - Rate limiting prevents brute force (10 attempts then timeout)

        - Case-insensitive emails (we're reasonable people)

        - Tokens expire after 1 week (nothing good lasts forever)


        **Token usage:**

        - Include in Authorization header: `Bearer <token>`

        - Refresh before expiry or start the login dance again
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              required:
                - email
                - password
              properties:
                email:
                  type: string
                  format: email
                  description: Your registered email (the one you hopefully remember)
                  example: hiring@techcorp.com
                password:
                  type: string
                  description: The random string we emailed (check spam folder)
                  example: abc123def456
      responses:
        '200':
          description: Authentication successful. You're in!
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/TokenResponse'
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/WrongCredentials'
        '422':
          $ref: '#/components/responses/ValidationError'
        '429':
          $ref: '#/components/responses/SlowDown'
        '500':
          $ref: '#/components/responses/ServerExistentialCrisis'
components:
  schemas:
    TokenResponse:
      type: object
      description: Authentication token response
      properties:
        access_token:
          type: string
          description: JWT bearer token for API authentication
          example: >-
            eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJjb21wYW55X2lkIjoiNjg1ZjViZGU5MjhkN2FhZDMyOWZhYmQ2IiwiZW1haWwiOiJhY0B0ZXN0LmNvbSIsImV4cCI6MTc1MTc2NDYwOSwiaWF0IjoxNzUxNTA1NDA5fQ.m5xD1XYrQL9uFSJz9A3DRwXIXsEcTojTyAbiNHajHck
        ws_token:
          type: string
          description: JWT bearer token for Websocket authentication
          example: >-
            eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJjb21wYW55X2lkIjoiNjg1ZjViZGU5MjhkN2FhZDMyOWZhYmQ2IiwiZW1haWwiOiJhY0B0ZXN0LmNvbSIsImV4cCI6MTc1MTc2NDYwOSwiaWF0IjoxNzUxNTA1NDA5fQ.m5xD1XYrQL9uFSJz9A3DRwXIXsEcTojTyAbiNHajHck
        token_type:
          type: string
          description: Token type (always 'bearer' because that's how JWT rolls)
          example: bearer
        expires_in:
          type: integer
          description: Token validity period in seconds (countdown to re-authentication)
          example: 604800
    ErrorResponse:
      type: object
      required:
        - error
        - message
      properties:
        error:
          type: string
          description: Machine-readable error identifier
        message:
          type: string
          description: Human-readable error explanation
  responses:
    BadRequest:
      description: Request was malformed or contained invalid data
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorResponse'
          example:
            error: empty_request_body
            message: Request body cannot be empty. Please include some data.
    WrongCredentials:
      description: Invalid email or password
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorResponse'
          example:
            error: authentication_failed
            message: Email or password is incorrect. Try the forgot password option.
    ValidationError:
      description: Input validation failed
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorResponse'
          examples:
            missing_email:
              value:
                error: missing_required_field
                message: Email field is required but was not provided.
            invalid_email:
              value:
                error: invalid_email_format
                message: The provided email address format is invalid.
    SlowDown:
      description: Rate limit exceeded
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorResponse'
          example:
            error: rate_limit_exceeded
            message: Too many requests. Please wait before trying again.
    ServerExistentialCrisis:
      description: Internal server error
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorResponse'
          example:
            error: internal_server_error
            message: Something went wrong on our end. We're looking into it.

````