Log In with Email and Password via POST /auth/login
Authenticate with email and password to receive a session cookie. Brute-force protection locks the account after 10 failed attempts for 15 minutes.
Logging in authenticates you with your email and password and sets an HttpOnly session cookie on the response. All subsequent authenticated API calls rely on that cookie being present. The endpoint also returns your account’s email verification status so your UI can prompt for verification if needed.
true if you have completed email verification, false otherwise. Some API features may require a verified email.
Brute-force lockout: After 10 consecutive failed login attempts the account is locked for 15 minutes. During the lockout period every attempt — including a correct password — returns 429 Too Many Requests. Wait for the cooldown to expire before trying again. Do not implement automated retry loops that could trigger or extend the lockout.
The email is not registered, the password is wrong, or the account combination could not be verified. The response deliberately avoids distinguishing between “email not found” and “wrong password” to prevent enumeration.
403 Forbidden
Account not accessible
The account has been suspended by an administrator or has been deleted. Contact support if you believe this is an error.
429 Too Many Requests
Rate limited / locked out
Either the per-IP rate limit was hit, or 10 failed attempts have triggered a 15-minute account lockout.