login

POST

/api/v1/auth/login

const url = 'https://example.com/api/v1/auth/login';
const options = {
  method: 'POST',
  headers: {'Content-Type': 'application/json'},
  body: '{"username":"example","password":"example"}'
};

try {
  const response = await fetch(url, options);
  const data = await response.json();
  console.log(data);
} catch (error) {
  console.error(error);
}

curl --request POST \
  --url https://example.com/api/v1/auth/login \
  --header 'Content-Type: application/json' \
  --data '{ "username": "example", "password": "example" }'

Rate-limited. Exchange an enrolled account’s credentials for a dashboard session.

Request Body^required

application/json

object

username

required

string

password

required

string

Example^generated

{
  "username": "example",
  "password": "example"
}

Responses

200

Signed in, or a multi-factor challenge when the account has a confirmed second factor. A challenge sets no session cookie.

application/json

object

data

required

One of:

object
object

object

user

required

object

required

string format: uuid

name

required

string

username

required

string

role

required

Role key. The built-in roles are owner, administrator, editor, contributor, and viewer. Custom role keys start with “custom.”. Decide authorization from the capabilities the server reports, not from the role key.

string

/^[a-z][a-z0-9.-]{1,63}$/

active

required

boolean

createdAt

required

string format: date-time

lastLoginAt

string format: date-time

capabilities

Effective capabilities of the signed-in user’s role.

Array<string>

csrfToken

required

string

authMethod

required

string

Allowed values: password totp passkey recovery_code demo

mfaEnrollmentRequired

required

boolean

Example

{
  "data": {
    "user": {
      "role": "owner"
    },
    "authMethod": "password"
  }
}

401

Invalid credentials

login

Request Bodyrequired

Examplegenerated

Responses

200

Example

401

Request Body^required

Example^generated