Skip to main content
Logging in authenticates you with your email and password and sets an HttpOnly session cookie on the response. All subsequent authenticated API calls rely on that cookie being present. The endpoint also returns your account’s email verification status so your UI can prompt for verification if needed.

Endpoint

This endpoint is public — no existing session or CSRF token is required.

Request Body

string
required
The email address associated with your account.
string
required
Your account password.

Example Request

Success Response — 200 OK

The session cookie is set and your account details are returned.
boolean
Always true for successful responses.
object
Brute-force lockout: After 10 consecutive failed login attempts the account is locked for 15 minutes. During the lockout period every attempt — including a correct password — returns 429 Too Many Requests. Wait for the cooldown to expire before trying again. Do not implement automated retry loops that could trigger or extend the lockout.

Error Responses

Example 401 Invalid Credentials

Example 403 Suspended Account

Example 429 Lockout

Next Steps

After a successful login, fetch a CSRF token before calling any state-changing endpoint:

Get a CSRF Token

Required before any POST, PATCH, or DELETE request.

View Current Session

Call GET /auth/session to confirm your session is active.