> ## Documentation Index
> Fetch the complete documentation index at: https://developers.mioesim.com/llms.txt
> Use this file to discover all available pages before exploring further.

# POST /api_order/login — Authenticate and get a token

> Exchange your MIOeSIM phone number and password for a session token. Include this token in every subsequent API request alongside a valid request signature.

Use this endpoint to authenticate and receive a session token. You must call this before making any other API request — all other endpoints require the `token` this endpoint returns.

```
POST https://bpm.mioesim.com/api_order/login
```

<Note>
  Tokens expire after **2 hours**. Logging in again immediately invalidates your previous token. Cache the token locally and refresh it proactively before it expires rather than calling login on every request.
</Note>

## Request parameters

<ParamField body="phonenumber" type="string" required>
  Your MIOeSIM account phone number. This is your login username.
</ParamField>

<ParamField body="password" type="string" required>
  Your MIOeSIM account password.
</ParamField>

<ParamField body="sign" type="string" required>
  Request signature computed from `phonenumber` and `password`. See [Computing the signature](/authentication#computing-the-signature) for the full algorithm.
</ParamField>

## Response fields

<ResponseField name="code" type="integer" required>
  Status code. `1` indicates success. Negative values indicate errors — see the error table below.
</ResponseField>

<ResponseField name="message" type="string" required>
  Human-readable status description.
</ResponseField>

<ResponseField name="data" type="object">
  Present on success. Contains the session token.

  <Expandable title="properties">
    <ResponseField name="token" type="string">
      Session token to include in all subsequent requests. Valid for 2 hours.
    </ResponseField>
  </Expandable>
</ResponseField>

## Error codes

| Code  | Meaning                                   |
| ----- | ----------------------------------------- |
| `1`   | Success — token returned in `data.token`  |
| `-1`  | Wrong username or password                |
| `-2`  | Username or password is empty             |
| `-3`  | Account does not have API call permission |
| `-30` | Signature (`sign`) is incorrect           |

<Warning>
  If you receive code `-30`, verify that your signature algorithm sorts all parameters alphabetically and that you are using the correct secret key. See [Computing the signature](/authentication#computing-the-signature).
</Warning>

## Example

<CodeGroup>
  ```bash cURL theme={null}
  curl --request POST \
    --url "https://bpm.mioesim.com/api_order/login" \
    --header "Content-Type: application/json" \
    --data '{
      "phonenumber": "13800000000",
      "password": "mypassword",
      "sign": "a1b2c3d4e5f67890abcdef1234567890"
    }'
  ```

  ```json Response theme={null}
  {
    "code": 1,
    "message": "Successful",
    "data": {
      "token": "29281-9EFE5E410BEF5300DD15E3830BD65601"
    }
  }
  ```
</CodeGroup>