Exchanges an email address and password for a session token.
HTTP
POST /auth/loginAccess: No token needed.
Request body #
JSON.
| Field | Type | Required | Description |
|---|---|---|---|
email | string | yes | The email address of the account. Not case sensitive. |
password | string | yes | The password. |
code | string | when two-factor authentication is on | A 6-digit code from the authenticator app, or a recovery code. Leave it out first: the answer mfa_required says it is needed. |
JSON
{ "email": "ada@example.com", "password": "correct horse battery" }Response 200 #
A session was started.
JSON
{
"token": "9f2c...e1",
"expiresAt": "2026-10-23T09:30:00+00:00",
"user": {
"id": "0197a3c2-5b1e-7c4a-9d2f-3e8b6a1f0c55",
"email": "ada@example.com",
"name": "Ada Lovelace",
"locale": "en-GB",
"mfaSetupRequired": false
}
}Response fields #
| Field | Type | Description |
|---|---|---|
token | string | The session token. Send it as Authorization: Bearer <token>. It is shown only once. |
expiresAt | string | When the token expires, as an ISO 8601 timestamp. A token lasts 7 days. |
user.id | string | The id of the user. |
user.email | string | The email address. |
user.name | string | The name. |
user.locale | string or null | The interface language the user picked, for example en-GB, or null until they pick one. |
user.mfaSetupRequired | boolean | true when the organisation requires two-factor authentication and the account has none. Every route except the ones for the account and two-factor setup answers 403 mfa_setup_required until it is set up. |
Errors #
| Status | error | When |
|---|---|---|
| 401 | invalid_credentials | The email address or the password is wrong. |
| 401 | mfa_required | The account uses two-factor authentication and code is missing. The password was right. |
| 401 | invalid_code | code is wrong or was used already. |
| 422 | invalid_request | email or password is missing. |
| 429 | rate_limited | Too many requests, see Rate limiting. |
See Errors for the error format.