> ## Documentation Index > Fetch the complete documentation index at: https://docs.skyvexsoftware.com/llms.txt > Use this file to discover all available pages before exploring further. # Credentials login > Exchange a pilot's username (pilot ID or email) and password for an API key. Returns the full pilot session including the `token` field that the client uses on every subsequent request as a Bearer token. ## OpenAPI ````yaml /api-reference/openapi.json post /pilot/login openapi: 3.1.0 info: title: Stratos Core API version: 0.3.0 summary: >- The Stratos VA API contract — auth, pilot identity, reference data, and the flight lifecycle. description: >- The contract every Stratos desktop client speaks to a virtual airline's crew system. The reference implementation is the open-source [stratos-core-api phpVMS 7 module](https://github.com/SkyvexSoftware/stratos-core-api), but any backend can implement these endpoints — they're framework-agnostic. Every endpoint in this reference is documented under `/api/stratos` — that's the convention the phpVMS module uses, and what we recommend for consistency. You're free to mount the surface anywhere you like; the desktop client just uses whatever base URL is set in your Stratos airline configuration. ## Authentication Most endpoints require a Bearer token — the pilot's API key, obtained via `POST /pilot/login` or your OAuth flow. Send as `Authorization: Bearer ` on every authenticated request. Public (no token): `GET /` and `POST /pilot/login`. ## Conventions - JSON, `snake_case` field names. - Distances in nautical miles, weights in pounds, flight times in decimal hours (unless suffixed `_minutes`). - Coordinates are decimal degrees (WGS84). - CORS is wide-open; the client preflights every method. servers: - url: '{baseUrl}' description: >- Your VA's Stratos API base — set this to whatever URL the Stratos client is pointed at, including any path prefix you chose to mount the surface under. variables: baseUrl: default: https://crew.example.com/api/stratos description: >- Full base URL including the path prefix (no trailing slash). The phpVMS reference module mounts under `/api/stratos`; if you mounted yours somewhere else (e.g. `https://api.youva.com/stratos/v1`), use that. security: - BearerAuth: [] tags: - name: Pilot description: Authentication, profile, and career statistics. - name: Reference Data description: Static lookup data the client renders in UI. - name: Flights description: >- Browse the schedule, manage bids, and run the active-flight lifecycle (start, update, complete, cancel). paths: /pilot/login: post: tags: - Pilot summary: Credentials login description: >- Exchange a pilot's username (pilot ID or email) and password for an API key. Returns the full pilot session including the `token` field that the client uses on every subsequent request as a Bearer token. operationId: pilotLogin requestBody: required: true content: application/json: schema: $ref: '#/components/schemas/LoginRequest' responses: '200': description: Credentials accepted. content: application/json: schema: $ref: '#/components/schemas/PilotSessionWithToken' '401': description: Username or password incorrect. content: application/json: schema: $ref: '#/components/schemas/LoginError' security: [] components: schemas: LoginRequest: type: object required: - username - password properties: username: type: string description: >- The pilot's displayed pilot ID (e.g. `QFA0001`) or their email address. example: QFA0001 password: type: string description: The user's password. format: password PilotSessionWithToken: allOf: - $ref: '#/components/schemas/PilotSession' - type: object required: - token properties: token: type: string description: >- The pilot's API key. Send as `Authorization: Bearer ` on every authenticated request. LoginError: type: object required: - success - error properties: success: type: boolean enum: - false error: type: string example: The username or password is incorrect PilotSession: type: object required: - db_id - pilot_id - first_name - last_name - email - rank - rank_image - rank_level - avatar properties: db_id: type: integer description: Internal database ID. Stable across pilot ID changes. pilot_id: type: string description: >- Display pilot ID (airline ICAO + zero-padded number per VA setting). Example: `QFA0001`. example: QFA0001 first_name: type: string last_name: type: string email: type: string format: email rank: type: string description: Human-readable rank name. example: First Officer rank_image: type: string format: uri nullable: true description: >- URL to the pilot's rank insignia image. The Stratos client renders this as a rank badge in the dashboard and pilot-centre plugins. Return `null` if the rank has no image. The phpVMS reference resolves this from the rank's `image_url` column (relative paths are wrapped in your phpVMS public URL automatically). rank_level: type: integer description: >- Numeric rank tier (0-based) — index into the rank ladder ordered ascending by required hours. Used by the Stratos client for any rank-gated UI behaviour. The phpVMS reference computes this as the count of ranks with fewer required hours than the pilot's current rank, matching phpVMS's own auto-promote ordering. avatar: type: string format: uri description: Absolute URL to the pilot's avatar image. securitySchemes: BearerAuth: type: http scheme: bearer description: >- The pilot's API key, obtained via `POST /pilot/login` or your OAuth flow. Send as `Authorization: Bearer ` on every authenticated request. ````