Login with identifier and password

POST

/v1/auth/login

Authenticates a user by identifier (email or phone) and password. If MFA is enabled, returns an MFA challenge (mfa_session_id, available methods) instead of tokens. Otherwise returns access and refresh tokens directly. Rate-limited at the gateway (auth_login). Returns 401 for invalid credentials, unverified account, or blocked user.

Authentication: none. Rate limit: auth_login (gateway).

Request

Body Params application/jsonRequired

Examples

Responses

🟢200

application/json

MFA challenge or tokens

Bodyapplication/json

🟠400BadRequest

🟠401Unauthorized

🟠403Forbidden

🟠404NotFound

🟠409Conflict

🔴500InternalError

Request Example

Shell

JavaScript

Java

Swift

curl --location '/v1/auth/login' \
--header 'Content-Type: application/json' \
--data '{
    "identifier": "string",
    "password": "string"
}'

Response Example

200 - Example 1

{
    "mfa_required": true,
    "mfa_session_id": "461e97b2-c859-4b19-98fe-554c7300bc07",
    "mfa_method": "string",
    "mfa_destination": "string",
    "available_methods": [
        "string"
    ],
    "access_token": "string",
    "refresh_token": "string",
    "expires_in": 0,
    "token_type": "string"
}

Modified at 2026-06-23 04:24:01

Get JSON Web Key Set

Logout and invalidate refresh token