> ## Documentation Index > Fetch the complete documentation index at: https://docs.server.express/llms.txt > Use this file to discover all available pages before exploring further. # Sign in with email and password > Checks the password and either issues a session or, when the account has a second factor (a passkey or a confirmed authenticator app), returns a short-lived pre-auth token instead. Pass that token to /v1/auth/2fa/code or /v1/auth/2fa/options + /v1/auth/2fa/verify to finish signing in. Rate-limited to 10 requests per 15 minutes per IP. After 20+ attempts on one address in an hour, or a burst from one IP, a Cloudflare Turnstile token is required and a missing or failed one returns 428 with `data.captchaRequired: true`. A banned account gets 403 with `code: ACCOUNT_BANNED`, but only after a correct password. Writes a LOGIN audit entry on success. ## OpenAPI ````yaml /api-reference/openapi.yaml post /v1/auth/login openapi: 3.1.0 info: title: Server.Express API version: 1.0.0 description: >- The customer-facing Server.Express API: auth, billing, tickets, cloud and dedicated servers, hosting, reselling and account management. Every response uses the `{ success, data | error }` envelope. contact: name: Server.Express url: https://server.express servers: - url: https://my.server.express/api description: Production security: - bearerAuth: [] - apiToken: [] tags: - name: API Tokens - name: Account - name: Auth - name: Cloud - name: Coupons - name: Credits - name: Dashboard - name: Dedicated - name: Health - name: Hosting - name: Integrations - name: Invoices - name: Livechat - name: Notifications - name: Passkeys - name: Payments - name: Products - name: Public - name: Public Invoices - name: Public Tools - name: Reseller - name: SSH Keys - name: Services - name: Tasks - name: Teams - name: Tickets - name: Web Hosting - name: Webhooks paths: /v1/auth/login: post: tags: - Auth summary: Sign in with email and password description: >- Checks the password and either issues a session or, when the account has a second factor (a passkey or a confirmed authenticator app), returns a short-lived pre-auth token instead. Pass that token to /v1/auth/2fa/code or /v1/auth/2fa/options + /v1/auth/2fa/verify to finish signing in. Rate-limited to 10 requests per 15 minutes per IP. After 20+ attempts on one address in an hour, or a burst from one IP, a Cloudflare Turnstile token is required and a missing or failed one returns 428 with `data.captchaRequired: true`. A banned account gets 403 with `code: ACCOUNT_BANNED`, but only after a correct password. Writes a LOGIN audit entry on success. operationId: publicAuthLogin requestBody: required: true content: application/json: schema: type: object required: - email - password properties: email: type: string format: email description: Matched case-insensitively (lowercased and trimmed). password: type: string captchaToken: type: string description: >- Cloudflare Turnstile token. Only checked once the server decides a challenge is needed. responses: '200': description: Signed in, or a second factor is required. content: application/json: schema: type: object required: - success - data properties: success: type: boolean const: true data: oneOf: - $ref: '#/components/schemas/PublicAuthSession' - $ref: '#/components/schemas/PublicAuthTwoFactorChallenge' '400': $ref: '#/components/responses/BadRequest' '401': $ref: '#/components/responses/Unauthorized' '403': $ref: '#/components/responses/Forbidden' '428': description: >- A captcha is required, or the one sent didn't verify. Show the challenge and retry. content: application/json: schema: $ref: '#/components/schemas/PublicAuthCaptchaRequiredError' '429': $ref: '#/components/responses/TooManyRequests' '500': $ref: '#/components/responses/ServerError' security: [] components: schemas: PublicAuthSession: type: object required: - accessToken - refreshToken - user properties: accessToken: type: string description: >- Access JWT, good for 15 minutes. Send as `Authorization: Bearer `. refreshToken: type: string description: >- Opaque refresh token (`se_rt_…`), good for 30 days and rotated on every use. user: $ref: '#/components/schemas/PublicAuthSessionUser' PublicAuthTwoFactorChallenge: type: object description: >- The first factor worked but the account has a second. No session yet — finish with /v1/auth/2fa/code or the passkey pair /v1/auth/2fa/options + /v1/auth/2fa/verify. required: - twoFactorRequired - preAuthToken - methods properties: twoFactorRequired: type: boolean const: true preAuthToken: type: string description: >- Short-lived JWT that's only good for the /v1/auth/2fa/* sign-in routes. methods: type: object description: Which second factors to offer. required: - passkey - totp - backupCode properties: passkey: type: boolean totp: type: boolean backupCode: type: boolean description: True when at least one unused backup code remains. PublicAuthCaptchaRequiredError: allOf: - $ref: '#/components/schemas/ErrorResponse' - type: object required: - data properties: data: type: object required: - captchaRequired properties: captchaRequired: type: boolean const: true PublicAuthSessionUser: type: object required: - id - email - firstName - lastName - role properties: id: type: string format: uuid email: type: string format: email firstName: type: string lastName: type: string role: type: string enum: - CLIENT - ADMIN ErrorResponse: type: object required: - success - error properties: success: type: boolean const: false error: type: string description: Human-readable error message. additionalProperties: true responses: BadRequest: description: Validation failed or the request is malformed. content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' Unauthorized: description: Missing, invalid or expired credentials. content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' Forbidden: description: >- Authenticated but not allowed (missing scope, not an admin, or not your resource). content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' TooManyRequests: description: Rate limit exceeded. content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' ServerError: description: Unexpected server error. content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' securitySchemes: bearerAuth: type: http scheme: bearer bearerFormat: JWT description: >- Session access token (JWT) from POST /v1/auth/login or /v1/auth/refresh. A session satisfies every API scope. apiToken: type: http scheme: bearer bearerFormat: se_live__ description: >- Personal API token created under Settings → API tokens. Only routes guarded by verifyApiAuth accept it, and the token must carry the scope named in the operation's x-required-scope. ```` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.