---
title: "Email and password sign-in"
method: POST
path: "/auth/login"
tags: ["Auth"]
---

# Email and password sign-in

`POST /auth/login`

## Request

- Base URL: `https://api.apphandoff.com/api`
- URL: `https://api.apphandoff.com/api/auth/login`
- Auth: none required

Supabase password grant. Allowed only from trusted frontend origins (same allowlist as magic link).
Magic link remains the default UX; password is optional for accounts that have one.

## Request body

- object
  - `email` string, email, required
  - `password` string, required

## Response `200`

Access and refresh tokens

- object
  - `token` string, required
  - `refresh_token` string
  - `expires_in` integer
  - `user` object

## Other responses

- `400`: Invalid request
- `401`: Not authenticated
- `403`: Forbidden
- `429`: Rate limited

---

[API](https://skmtc.dev/apphandoff/apis/apphandoff-api.md) · [All operations](https://skmtc.dev/apphandoff/apis/apphandoff-api/llms.txt) · [OpenAPI document](https://skmtc.dev/apphandoff/apis/apphandoff-api/revisions/9f138fe46d56?raw)