Sign in with an email address and password
Sign in with an email address and password
/api/v1/auth/loginVerifies the password. When the account has no second factor this
issues a browser session directly. When it does, the response instead
carries a short-lived challenge and no session is created: the
caller must complete verifyMFA before anything is readable.
Both outcomes are 200, and the two bodies are told apart by the
mfa_required field. A client must branch on it rather than assuming
a session exists.
Every failure returns the same 401 invalid_credentials whatever went
wrong — unknown address, no password credential on the account, or a
wrong password — and the server spends comparable time in each case.
Distinguishing them would turn this endpoint into an oracle for which
addresses are registered.
Request Body
application/jsonstring <email>·min 3·max 320Normalized to lowercase and trimmed before storage and comparison.
string <password>·min 12·max 128Between 12 and 128 characters. There are deliberately no composition rules: length and non-reuse resist guessing, while character-class rules mostly produce predictable substitutions. Passwords appearing in a known breach corpus are refused.
booleanWhether to remember this device. true (the default when omitted,
which preserves earlier client behavior) issues a persistent
session cookie with the 7-day idle and 30-day absolute lifetimes.
false issues a browser-session cookie that the browser discards
when it closes, and the server bounds the session to 48 hours,
idle and absolute.
Responses
string·const no-storePrevents storage of error responses by clients and intermediaries.
string·min 1·max 200Correlation identifier for the request.
string·const nosniffPrevents user agents from MIME-sniffing the response.
string·const no-storePrevents storage of error responses by clients and intermediaries.
string·min 1·max 200Correlation identifier for the request.
string·const nosniffPrevents user agents from MIME-sniffing the response.
integer·min 1Seconds until the client may retry.
integer·min 0Delay in seconds before retrying, when an expected maintenance end is known.
string·const no-storePrevents storage of error responses by clients and intermediaries.
string·min 1·max 200Correlation identifier for the request.
string·const nosniffPrevents user agents from MIME-sniffing the response.