---
title: "Login User"
method: POST
path: "/api/user/login"
tags: ["user"]
---

# Login User

`POST /api/user/login`

Login with Ed25519 signature verification (local or SSO).

Authentication flow:
1. Client derives Ed25519 keypair from password
2. Client signs "email|timestamp" with Ed25519 private key
3. Server verifies signature using stored Ed25519 public key
4. Server encrypts response with stored X25519 public key

For SSO users: Also validates SSO token before proceeding.

Returns encrypted login response that only the correct password can decrypt.

## Request body

- LoginRequest — Unified login request (local and SSO). For local users: email + signature + timestamp For SSO users: email + signature + timestamp + sso_token Authentication flow: 1. Client derives Ed25519 keypair from password 2. Client signs "email|timestamp" with Ed25519 private key 3. Server verifies signature using stored Ed25519 public key 4. Server derives X25519 from Ed25519 for session key encryption
  - `email` string, email, required
  - `signature` string, required
  - `timestamp` integer, required
  - `sso_token` string, nullable

## Response `200`

Successful Response

- LoginResponse — Login response with access token, session key, and user info. Used by: /user/login
  - `access_token` string, required
  - `session_key` string, required
  - `user` UserResponse, required — Standard user representation used across all endpoints. Used for: login response, workspace users, contacts (when registered).
    - `external_id` string, required
    - `email` string, required
    - `given_name` string, required
    - `family_name` string, required
    - `picture` string, nullable
    - `encryption_public_key` string, required

## Other responses

- `422` — Validation Error

## Changes

- **2025-12-25** `aa4b06f8dede` — 2 breaking, 1 warning, 3 info
  - added the new required request property `signature`
  - added the new required request property `timestamp`
  - removed the request property `public_key`
  - added the required property `access_token` to the response with the `200` status
  - …2 more
- **2025-10-28** `849d5e8732f6` — 4 breaking, 1 warning, 1 info
  - added the new required request property `public_key`
  - removed the required property `access_token` from the response with the `200` status
  - removed the required property `token_type` from the response with the `200` status
  - removed the required property `user_ext_id` from the response with the `200` status
  - …2 more

[Change history](https://skmtc.dev/arbicity/apis/arbi/changes/api/user/login/post.md)

---

[API](https://skmtc.dev/arbicity/apis/arbi.md) · [All operations](https://skmtc.dev/arbicity/apis/arbi/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/arbicity/arbi/revisions/1f956ac3d1c1/schema)