Skip to main content
POST
Login
Authenticates a user with email and password credentials. Returns JWT access and refresh tokens on success. If the account has two-factor authentication enabled, the twoFactorCode field is required.

Auth

None required.

Rate Limit

20 requests per minute per IP.

Request Body

string
required
User email address.
string
required
User password.
string
6-digit TOTP code from an authenticator app. Required only if 2FA is enabled on the account.

Response

string
JWT access token. Expires in 15 minutes.
string
JWT refresh token. Expires in 7 days. Use this to obtain new token pairs.
number
Access token expiry in seconds (900).
object
Authenticated user profile object.

Errors

Example

With 2FA: