Sign in
user

Login User

Login with Ed25519 signature verification (local or SSO).

Authentication flow:

  1. Client derives Ed25519 keypair from password
  2. Client signs "email|timestamp" with Ed25519 private key
  3. Server verifies signature using stored Ed25519 public key
  4. Server encrypts response with stored X25519 public key

For SSO users: Also validates SSO token before proceeding.

Returns encrypted login response that only the correct password can decrypt.

post/api/user/login

Request body

emailstring email required
signaturestring required
timestampinteger required
sso_tokenstring nullable

Response

Successful Response

access_tokenstring required
session_keystring required

Changes

Changed in 2 of the 34 revisions of this API.624

  • aa4b06f8dede213See the full diff
    • ▲

      added the new required request property signature

      new-required-request-property

    • ▲

      added the new required request property timestamp

      new-required-request-property

    • ●

      removed the request property public_key

      request-property-removed

    • ○

      added the required property access_token to the response with the 200 status

      response-required-property-added

    • ○

      added the required property session_key to the response with the 200 status

      response-required-property-added

    • ○

      added the required property user to the response with the 200 status

      response-required-property-added

    This revision also has 2 changes that name no endpoint, such as unreferenced schemas being removed. See the revision's changelog

  • 849d5e8732f6411See the full diff
    • ▲

      added the new required request property public_key

      new-required-request-property

    • ▲

      removed the required property access_token from the response with the 200 status

      response-required-property-removed

    • ▲

      removed the required property token_type from the response with the 200 status

      response-required-property-removed

    • ▲

      removed the required property user_ext_id from the response with the 200 status

      response-required-property-removed

    • ●

      removed the request property password

      request-property-removed

    • ○

      added the new optional request property sso_token

      new-optional-request-property

    This revision also has 8 changes that name no endpoint, such as unreferenced schemas being removed. See the revision's changelog