diff --git a/api/src/ProposalSystem.Api/Controllers/AuthController.cs b/api/src/ProposalSystem.Api/Controllers/AuthController.cs
index 247d122..19dcf12 100644
--- a/api/src/ProposalSystem.Api/Controllers/AuthController.cs
+++ b/api/src/ProposalSystem.Api/Controllers/AuthController.cs
@@ -99,7 +99,13 @@ public class AuthController : ControllerBase
         if (string.IsNullOrEmpty(signingKey))
             return StatusCode(500, new { message = "Dev signing key not configured" });
 
-        var role = Enum.TryParse<UserRole>(request.Role, true, out var parsed) ? parsed : UserRole.Admin;
+        if (string.IsNullOrWhiteSpace(request.Email))
+            return BadRequest(new { message = "Email is required" });
+
+        if (!string.IsNullOrEmpty(request.Role) && !Enum.TryParse<UserRole>(request.Role, true, out _))
+            return BadRequest(new { message = $"Invalid role: '{request.Role}'. Valid roles are: Dispatcher, Admin, SysAdmin" });
+
+        var role = Enum.TryParse<UserRole>(request.Role, true, out var parsed) ? parsed : UserRole.Dispatcher;
 
         var user = await _db.Users.FirstOrDefaultAsync(u => u.Email == request.Email, ct);
         if (user == null)