Sign in with email and password
curl --request POST \
--url https://my.server.express/api/v1/auth/login \
--header 'Content-Type: application/json' \
--data '
{
"email": "[email protected]",
"password": "<string>",
"captchaToken": "<string>"
}
'const options = {
method: 'POST',
headers: {'Content-Type': 'application/json'},
body: JSON.stringify({email: '[email protected]', password: '<string>', captchaToken: '<string>'})
};
fetch('https://my.server.express/api/v1/auth/login', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));import requests
url = "https://my.server.express/api/v1/auth/login"
payload = {
"email": "[email protected]",
"password": "<string>",
"captchaToken": "<string>"
}
headers = {"Content-Type": "application/json"}
response = requests.post(url, json=payload, headers=headers)
print(response.text){
"success": true,
"data": {
"accessToken": "<string>",
"refreshToken": "<string>",
"user": {
"id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"email": "[email protected]",
"firstName": "<string>",
"lastName": "<string>",
"role": "CLIENT"
}
}
}{
"success": false,
"error": "<string>"
}{
"success": false,
"error": "<string>"
}{
"success": false,
"error": "<string>"
}{
"success": false,
"error": "<string>",
"data": {
"captchaRequired": true
}
}{
"success": false,
"error": "<string>"
}{
"success": false,
"error": "<string>"
}Auth
Sign in with email and password
Checks the password and either issues a session or, when the account has a second factor (a passkey or a confirmed authenticator app), returns a short-lived pre-auth token instead. Pass that token to /v1/auth/2fa/code or /v1/auth/2fa/options + /v1/auth/2fa/verify to finish signing in. Rate-limited to 10 requests per 15 minutes per IP. After 20+ attempts on one address in an hour, or a burst from one IP, a Cloudflare Turnstile token is required and a missing or failed one returns 428 with data.captchaRequired: true. A banned account gets 403 with code: ACCOUNT_BANNED, but only after a correct password. Writes a LOGIN audit entry on success.
POST
/
v1
/
auth
/
login
Sign in with email and password
curl --request POST \
--url https://my.server.express/api/v1/auth/login \
--header 'Content-Type: application/json' \
--data '
{
"email": "[email protected]",
"password": "<string>",
"captchaToken": "<string>"
}
'const options = {
method: 'POST',
headers: {'Content-Type': 'application/json'},
body: JSON.stringify({email: '[email protected]', password: '<string>', captchaToken: '<string>'})
};
fetch('https://my.server.express/api/v1/auth/login', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));import requests
url = "https://my.server.express/api/v1/auth/login"
payload = {
"email": "[email protected]",
"password": "<string>",
"captchaToken": "<string>"
}
headers = {"Content-Type": "application/json"}
response = requests.post(url, json=payload, headers=headers)
print(response.text){
"success": true,
"data": {
"accessToken": "<string>",
"refreshToken": "<string>",
"user": {
"id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"email": "[email protected]",
"firstName": "<string>",
"lastName": "<string>",
"role": "CLIENT"
}
}
}{
"success": false,
"error": "<string>"
}{
"success": false,
"error": "<string>"
}{
"success": false,
"error": "<string>"
}{
"success": false,
"error": "<string>",
"data": {
"captchaRequired": true
}
}{
"success": false,
"error": "<string>"
}{
"success": false,
"error": "<string>"
}Body
application/json