---
title: "Login"
method: POST
path: "/api/auth/login"
tags: ["Auth"]
---

# Login

`POST /api/auth/login`

Authenticate with email and password.

Returns a Bearer token valid for 30 days.
If MFA is enabled, returns mfa_required=True with a challenge_id instead.

## Request body

- LoginRequest
  - `email` string, required
  - `password` string, required

## Response `200`

Successful Response

- unknown

## Other responses

- `422` — Validation Error

## Changes

> 22 revisions in range; 2 could not be searched.

- **2026-06-08** `cbe3ad94235c` — 2 breaking, 2 warning
  - the `email` request property's minLength was increased from `0` to `5`
  - the `password` request property's minLength was increased from `0` to `8`
  - the `email` request property's maxLength was set to `128`
  - the `password` request property's maxLength was set to `128`

[Change history](https://skmtc.dev/aabiro/apis/xcelsior/changes/api/auth/login/post.md)

---

[API](https://skmtc.dev/aabiro/apis/xcelsior.md) · [All operations](https://skmtc.dev/aabiro/apis/xcelsior/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/aabiro/xcelsior/revisions/32211b6f9d65/schema)