---
title: "Login User"
method: POST
path: "/api/user/login"
tags: ["user"]
---

# Login User

`POST /api/user/login`

Login with X25519 public key verification (local or SSO).

SIMPLEST POSSIBLE AUTH: Client derives X25519 public key from password and sends it.
Server compares with stored public key. Match = correct password!

For SSO users: Also validates SSO token before proceeding.
For local users: Only public key verification needed.

Returns encrypted login response that only the correct password can decrypt.

## Request body

- LoginRequest — Unified login request (local and SSO). For local users: email + public_key For SSO users: email + public_key + sso_token
  - `email` string, email, required
  - `public_key` string, required
  - `sso_token` string, nullable

## Response `200`

Successful Response

- object

## Other responses

- `422` — Validation Error

## Changes

- **2025-10-28** `849d5e8732f6` — 4 breaking, 1 warning, 1 info
  - added the new required request property `public_key`
  - removed the required property `access_token` from the response with the `200` status
  - removed the required property `token_type` from the response with the `200` status
  - removed the required property `user_ext_id` from the response with the `200` status
  - …2 more

[Change history](https://skmtc.dev/arbicity/apis/arbi/changes/api/user/login/post.md)

---

[API](https://skmtc.dev/arbicity/apis/arbi.md) · [All operations](https://skmtc.dev/arbicity/apis/arbi/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/arbicity/arbi/revisions/2cd7c0e6303a/schema)