Prepared for: Backend, Frontend & ML Engineering Teams Version: 1.0 | February 2026
Backend Processes:
Validate email format and password strength
Lookup user by email in PostgreSQL
bcrypt password comparison
Check account status (active, suspended, pending KYC)
Generate JWT with role claims (exp: 1h access, 30d refresh)
Log login event to audit trail
If remember_device=true, set device fingerprint cookie (30d)
Database Interactions: SELECT from users, INSERT into session_logs
API Endpoint: POST /api/v1/auth/login
ML Interaction: Login behavior anomaly scoring — new IP, device fingerprint mismatch triggers elevated risk score
Edge Cases: Account locked after 5 failed attempts, unverified email, suspended org