Log in with email + password. Sets an `HttpOnly` session cookie. Repeated failures are throttled (`429` with `Retry-After`).

POST

/api/v1/auth/login

curl --request POST \
  --url https://example.com/api/v1/auth/login \
  --header 'Content-Type: application/json' \
  --data '{ "email": "admin@kuben.local", "password": "correct horse battery staple" }'

Request Body^required

Media typeapplication/json

object

email

required

string

Example

admin@kuben.local

password

required

string format: password

Example

correct horse battery staple

Responses

200

Logged in

Media typeapplication/json

object

id

required

string

email

required

string

display_name

string | null

via

required

How the request was authenticated: session or token.

string

must_change_password

required

The temporary password must be replaced (POST /me/password) before anything else is allowed.

boolean

Example^generated

{
  "id": "example",
  "email": "example",
  "display_name": "example",
  "via": "example",
  "must_change_password": true
}

401

Bad credentials

Media typeapplication/json

Problem Details body.

object

code

required

Stable machine-readable code, e.g. forbidden.

string

title

required

Short human readable title.

string

status

required

HTTP status.

integer format: int32

detail

Details, if safe to expose.

string | null

Example

{
  "code": "forbidden"
}

429

Too many failed attempts

Media typeapplication/json

Problem Details body.

object

code

required

Stable machine-readable code, e.g. forbidden.

string

title

required

Short human readable title.

string

status

required

HTTP status.

integer format: int32

detail

Details, if safe to expose.

string | null

Example

{
  "code": "forbidden"
}