Log in from the native password screen

POST/api/v1/mobile/auth/login

First-party native email/password authentication. No browser, callback, cookies, client secret or platform-store registration is involved. Use the fixed client matching the platform and the installation binding. Core preserves password policy, account state, rate limits and MFA. Login returns mfa_required=true with a five-minute, five-attempt challenge when enrolled; no credential is issued before verification. Native MFA challenges cannot be redeemed by browser MFA or another installation. Registration creates an unverified account and sends verification email; verification gates recovery, not access. A verification_delivery_failed response means the account exists; request another email and log in. Passwords and challenges are memory-only; never log or automatically retry.

Request Body

application/json

client_idRequired

string

Values

assign-iosassign-android

platformRequired

string

Values

iosandroid

installation_idRequired

string <password>·min 43·max 128

device_labelRequired

string·min 1·max 64

emailRequired

string <email>·min 3·max 320

Normalized to lowercase and trimmed before storage and comparison.

passwordRequired

string <password>·min 12·max 128

Between 12 and 128 characters. There are deliberately no composition rules: length and non-reuse resist guessing, while character-class rules mostly produce predictable substitutions. Passwords appearing in a known breach corpus are refused.

Responses

Authentication · Conventions and errors · API guides · Resource reference

Log in from the native password screen