diff --git a/app/Http/Controllers/AuthController.php b/app/Http/Controllers/AuthController.php
index 5be3027..0d0b9b2 100644
--- a/app/Http/Controllers/AuthController.php
+++ b/app/Http/Controllers/AuthController.php
@@ -2,6 +2,7 @@
 
 namespace App\Http\Controllers;
 
+use App\Http\Requests\SendRoomSwitchCommandRequest;
 use Illuminate\Http\Request;
 use Illuminate\Support\Facades\Auth;
 use Illuminate\Support\Facades\Hash;
@@ -16,6 +17,64 @@ use OpenApi\Annotations as OA;
  */
 class AuthController extends Controller
 {
+    /**
+     * @OA\Post(
+     *     path="/api/login",
+     *     tags={"Auth"},
+     *     summary="登入取得 Token",
+     *     description="使用帳號密碼登入並回傳 JWT Token。",
+     *     operationId="login",
+     *     @OA\RequestBody(
+     *         required=true,
+     *         @OA\JsonContent(ref="#/components/schemas/ReceiveLoginRequest")
+     *     ),
+     *     @OA\Response(
+     *         response=200,
+     *         description="成功傳送指令並回傳 TCP 回應",
+     *         @OA\JsonContent(
+     *             allOf={
+     *                 @OA\Schema(ref="#/components/schemas/ApiResponse"),
+     *                 @OA\Schema(
+     *                      @OA\Property(property="data", type="object",
+     *                          @OA\Property(property="token", type="string", example="eyJhbGciOiJIUz...")
+     *                      )
+     *                 )
+     *             }
+     *         )
+     *     ),
+     *     @OA\Response(
+     *         response=401,
+     *         description="Unauthorized",
+     *         @OA\JsonContent(
+     *             allOf={
+     *                 @OA\Schema(ref="#/components/schemas/ApiResponse"),
+     *                 @OA\Schema(
+     *                     @OA\Property(property="code", type="string", example="UNAUTHORIZED"),
+     *                     @OA\Property(property="message", type="string", example="Unauthorized"),
+     *                     @OA\Property(property="data", type="null")
+     *                 )
+     *             }
+     *         )
+     *     )
+     * )
+     */
+    public function login(ReceiveLoginRequest $request)
+    {
+        if (!Auth::attempt($request->only('email', 'password'))) {
+            return ApiResponse::unauthorized(); 
+        }
+        $user = Auth::user();
+        // 3. 產生或取得 Token
+        if (empty($user->api_plain_token)) {
+            $token = $user->createToken('*')->plainTextToken;
+            $user->api_plain_token = $token;
+            $user->save();
+        } else {
+            $token = $user->api_plain_token;
+        }
+        return \App\Http\Responses\ApiResponse::success(['token' => $token]);
+    }
+
     /**
      * @OA\Get(
      *     path="/api/profile",
diff --git a/app/Http/Requests/ReceiveLoginRequest.php b/app/Http/Requests/ReceiveLoginRequest.php
new file mode 100644
index 0000000..2f69c76
--- /dev/null
+++ b/app/Http/Requests/ReceiveLoginRequest.php
@@ -0,0 +1,29 @@
+<?php
+
+namespace App\Http\Requests;
+
+use Illuminate\Foundation\Http\FormRequest;
+
+/**
+ * @OA\Schema(
+ *     schema="ReceiveLoginRequest",
+ *     required={"email" ,"password"},
+ *     @OA\Property(property="email", type="string", example="XX@gmail.com"),
+ *     @OA\Property(property="password", type="string", example="XXX"),
+ * )
+ */
+class ReceiveLoginRequest extends ApiRequest
+{
+    /**
+     * Get the validation rules that apply to the request.
+     *
+     * @return array<string, \Illuminate\Contracts\Validation\ValidationRule|array<mixed>|string>
+     */
+    public function rules(): array
+    {
+        return [
+            'email' => 'required|email',
+            'password' => 'required',
+        ];
+    }
+}
diff --git a/routes/api.php b/routes/api.php
index 5259197..6233f94 100644
--- a/routes/api.php
+++ b/routes/api.php
@@ -7,6 +7,7 @@ use App\Http\Controllers\RoomControlController;
 
 Route::get('/artists/search', [App\Http\Controllers\ArtistController::class, 'search'])->name('api.artists.search');
 
+Route::post('/login', [AuthController::class, 'login']);
 Route::post('/room/receiveRegister', [RoomControlController::class, 'receiveRegister']);
 
 Route::middleware('auth:sanctum')->group(function () {