The login endpoint /api/login is ALREADY PART of the api-platform distribution – ONLY security.yaml needs to ACTIVATE it correctly.

Configuring security.yaml

security:
    password_hashers:
        App\Entity\User: 'auto'
    providers:
        app_user_provider:
            entity:
                class: App\Entity\User
                property: email
    firewalls:
        login:
            pattern: ^/api/login
            stateless: true
            json_login:
                check_path: /api/login
                username_path: email
                password_path: password
                success_handler: lexik_jwt_authentication.handler.authentication_success
                failure_handler: lexik_jwt_authentication.handler.authentication_failure
        api:
            pattern: ^/api
            stateless: true
            jwt: ~
    access_control:
        - { path: ^/api/login, roles: PUBLIC_ACCESS }
        - { path: ^/api/docs, roles: PUBLIC_ACCESS }
        - { path: ^/api, roles: IS_AUTHENTICATED_FULLY }

TWO SEPARATE firewalls: login for obtaining a TOKEN (via email/password), api for ALL other endpoints (via JWT token). stateless: true is DECISIVE – NO server session, EVERY request carries ITS OWN authentication.

Creating a user

curl -k -X POST https://localhost/api/users \
  -H 'Content-Type: application/json' \
  -d '{"email": "max@example.com", "plainPassword": "a-secure-password-123"}'

Requesting a token

curl -k -X POST https://localhost/api/login \
  -H 'Content-Type: application/json' \
  -d '{"email": "max@example.com", "password": "a-secure-password-123"}'

{
  "token": "eyJ0eXAiOiJKV1QiLCJhbGciOiJSUzI1NiJ9.eyJpYXQiOjE3NTQ1..."
}

Wrong credentials

curl -k -i -X POST https://localhost/api/login \
  -H 'Content-Type: application/json' \
  -d '{"email": "max@example.com", "password": "wrong"}'

Status 401 Unauthorized – NO indication of WHETHER the email exists or ONLY the password is wrong. This DELIBERATE vagueness prevents attackers from GUESSING registered email addresses.