---
title: "POST /auth"
method: POST
path: "/auth"
tags: ["Authentication"]
---

# POST /auth

`POST /auth`

## Request

- Base URL: `https://api.akeyless.io`
- URL: `https://api.akeyless.io/auth`
- Auth: none declared

## Request body

- Auth
  - `access-id` string: Access ID
  - `access-key` string: Access key (relevant only for access-type=access_key)
  - `access-type` string: Access Type (access_key/password/saml/ldap/k8s/azure_ad/oidc/aws_iam/alicloud/universal_identity/jwt/gcp/cert/oci/kerberos)
  - `account-id` string: Account id (relevant only for access-type=password where the email address is associated with more than one account)
  - `admin-email` string: Email (relevant only for access-type=password)
  - `admin-password` string: Password (relevant only for access-type=password)
  - `azure-cloud` string: Azure cloud environment to use. Values: AzureCloud (default), AzureUSGovernment, AzureChinaCloud.
  - `cert-challenge` string: Certificate challenge encoded in base64. (relevant only for access-type=cert)
  - `cert-data` string: Certificate data encoded in base64. Used if file was not provided. (relevant only for access-type=cert)
  - `cloud-id` string: The cloud identity (relevant only for access-type=azure_ad,aws_iam,alicloud,gcp,oci)
  - `debug` boolean
  - `disable-pafxfast` string: Disable the FAST negotiation in the Kerberos authentication method
  - `gateway-spn` string: The service principal name of the gateway as registered in LDAP (i.e., HTTP/gateway)
  - `gateway-url` string: Gateway URL relevant only for access-type=k8s/oauth2/saml/oidc
  - `gcp-audience` string: GCP JWT audience
  - `json` boolean: Set output format to JSON
  - `jwt` string: The Json Web Token (relevant only for access-type=jwt/oidc)
  - `k8s-auth-config-name` string: The K8S Auth config name (relevant only for access-type=k8s)
  - `k8s-service-account-token` string: The K8S service account token. (relevant only for access-type=k8s)
  - `kerberos-token` string: KerberosToken represents a Kerberos token generated for the gateway SPN (Service Principal Name).
  - `kerberos-username` string: TThe username for the entry within the keytab to authenticate via Kerberos
  - `key-data` string: Private key data encoded in base64. Used if file was not provided.(relevant only for access-type=cert)
  - `keytab-data` string: Base64-encoded content of a valid keytab file, containing the service account's entry.
  - `krb5-conf-data` string: Base64-encoded content of a valid krb5.conf file, specifying the settings and parameters required for Kerberos authentication.
  - `ldap-password` string: LDAP password (relevant only for access-type=ldap)
  - `oci-auth-type` string: The type of the OCI configuration to use [instance/apikey/resource] (relevant only for access-type=oci)
  - `oci-group-ocid` string[]: A list of Oracle Cloud IDs groups (relevant only for access-type=oci)
  - `otp` string
  - `signed-cert-challenge` string: Signed certificate challenge encoded in base64. (relevant only for access-type=cert)
  - `uid-token` string: The universal_identity token (relevant only for access-type=universal_identity)
  - `use-remote-browser` boolean: Returns a link to complete the authentication remotely (relevant only for access-type=saml/oidc)
  - `username` string: LDAP username (relevant only for access-type=ldap)

## Response `200`

authResponse wraps response body.

- AuthOutput
  - `complete_auth_link` string
  - `creds` SystemAccessCredentialsReplyObj
    - `access_id` string
    - `auth_creds` string: Temporary credentials for accessing Auth
    - `csrf_token` string: CSRF token for synchronizer-token pattern (only populated for WebUI clients)
    - `expiry` integer: Credentials expiration date
    - `kfm_creds` string: Temporary credentials for accessing the KFMs instances
    - `need_mfa_app_first_config` boolean: If the user didn't complete to configure the MFA app
    - `recovery_key_id` string: RecoveryKeyID identifies the DPoP-bound recovery key for WebUI session recovery.
    - `required_mfa` string
    - `sub_claims` object: SubClaims carries the IdP-verified RBAC claims for offline placeholder creds (empty UAM JWT); parsed from the ID token at callback time.
    - `token` string: Credentials tmp token
    - `uam_creds` string: Temporary credentials for accessing the UAM service
    - `unique_id` string: UniqueId is set only on Gateway-minted offline placeholder creds (empty UAM JWT), carrying the IdP unique identifier so usage-time RBAC can resolve identity.
  - `expiration` string
  - `token` string

## Other responses

- `401`: errorResponse wraps any error to return it as a JSON object with one "error" field.
- `default`: errorResponse wraps any error to return it as a JSON object with one "error" field.

---

[API](https://skmtc.dev/akeyless/apis/identity-access.md) - [All operations](https://skmtc.dev/akeyless/apis/identity-access/llms.txt) - [OpenAPI document](https://skmtc.dev/akeyless/apis/identity-access/revisions/6fbc3858ec88?raw)