Test users

Seeded accounts. They exist for local/dev only — never in production. All passwords are password.

Customers (client app)

Seeded with a ClientProfile and a wallet. Customers normally authenticate by phone OTP (see below).

Name	Phone	Email
Ana Martínez	`+584241000001`	`ana@test.com`
Luis Fernández	`+584241000002`	`luis@test.com`
Sofía Vargas	`+584241000003`	`sofia@test.com`
Pedro Salazar	`+584241000004`	`pedro@test.com`
Laura Díaz	`+584241000005`	`laura@test.com`

Drivers (cisternero app)

Seeded with status = ACTIVE, kyc_state = APPROVED, a vehicle, and approved documents.

Name	Phone	Email	Vehicle	Capacity	Online
Carlos Rodríguez	`+584241001001`	`carlos@test.com`	`ABC-123` (Ford F-350)	5 000 L	yes
María González	`+584241001002`	`maria@test.com`	`XYZ-456` (Chevrolet Express)	3 000 L	yes
José Pérez	`+584241001003`	`jose@test.com`	`DEF-789` (Hino 300)	7 000 L	no (offline)

Admin (back office)

Name	Email	Password	Role
Admin Principal	`admin@aguita.app`	`password`	super admin

Admins authenticate with email + password:

curl -X POST /api/v1/admin/auth/login \
  -H "Content-Type: application/json" \
  -d '{"email": "admin@aguita.app", "password": "password"}'

Authenticating as a customer/driver in dev

Two non-production options:

A. Phone OTP — outside production the send endpoint returns the code:

curl -X POST /api/v1/auth/otp/request \
  -H "Content-Type: application/json" \
  -d '{"phone": "+584241000001"}'
# → { "sent": true, "mocked": true, "code": "123456" }

curl -X POST /api/v1/auth/otp/verify \
  -H "Content-Type: application/json" \
  -d '{"phone": "+584241000001", "code": "123456", "app": "client"}'

B. Dev token — mint a token directly (non-production only). Look up the user id first, then exchange it:

curl "/api/v1/auth/dev-lookup?phone=+584241001001"     # → { "userId": 7, ... }
curl -X POST /api/v1/auth/dev-token \
  -H "Content-Type: application/json" \
  -d '{"userId": 7, "app": "driver"}'

See Auth for the full request/response shapes.