Authenticate (Cards service account)

Issues a Cards service-account JWT for the given institution. Used by the monolith EncoreCardsGateway and other service clients before calling Cards endpoints.

Note: This is not the global LXP user login. It authenticates against the Cards admins table (legacy AES or bcrypt password).

Request Example

curl --request POST \
  --url 'https://lxp.prod.api.toolzz.media/authenticate' \
  --header 'Content-Type: application/json' \
  --data '{
    "email": "cards-service@example.com",
    "password": "<password>",
    "institution_id": 39955387
  }'

institution_id (or toolzz_institution_id) may also be sent as a query parameter.

Response Example

{
  "token": "<jwt>"
}

Use the token as Authorization: Bearer <jwt> on subsequent Cards calls.

---

Request description

Body Parameters

Parameter	Type	Description	Required
email	string	Cards admin email.	Yes
password	string	Cards admin password.	Yes
institution_id	number	Institution ID stamped into the JWT (alias: toolzz_institution_id).	Yes

---

Response description

Key	Type	Description
token	string	JWT for Cards service calls, scoped to the institution.

---

Error responses

HTTP	Code	When
400	invalid_argument	Missing email/password/institution
401	unauthenticated	Invalid credentials
500	internal	Unexpected failure

---

Security

• Public endpoint (no prior JWT).
• Credentials must match a row in Cards admins.
• Token institution scope is fixed at authenticate time.