---
title: "User Login – Generate JWT Tokens"
method: POST
path: "/account/auth/login"
tags: ["Auth - Login"]
---

# User Login – Generate JWT Tokens

`POST /account/auth/login`

This endpoint performs user authentication and issues the user's JWT tokens. The response depends on whether multi-factor authentication (MFA) is enabled for the user:
 - If the user does not have MFA enabled, the API returns a TokenPair object containing the access_token and refresh_token, allowing immediate authentication.
 - If the user has MFA enabled, the response returns an MFAToken object. This temporary token must be used in the MFA verification endpoint to complete authentication. After successful verification of the second factor, the TokenPair is issued.

## Request body

- LoginRequest
  - `email` string, email, required
  - `password` string, required — User password
  - `account_id` integer, nullable

## Response `201`

User authenticated successfully. Returns JWT tokens or MFA token if MFA is enabled.

- ResponseLogin
  - `data` union, required
    - object — Used when user does not have MFA enabled or after successful MFA verification. Returns both access and refresh tokens for API authentication.
      - `access_token` string, required — The access_token is a short-lived token (e.g., 10 minutes) used for API authentication in the Authorization: Bearer <access_token> header.
      - `refresh_token` string, required — A long-lived JWT token used to refresh the access_token without requiring the user to authenticate again.
      - `response_type` 'TokenPair', required — Discriminator field for LoginResponse
    - object — Used when user has MFA enabled. Returns a temporary MFA token that must be verified with a TOTP code before receiving full access tokens.
      - `access_token` string, required — The access_token is a short-lived token (e.g., 10 minutes) used for API authentication in the Authorization: Bearer <access_token> header.
      - `two_factor_required` boolean, required — Specifies the type of two-factor authentication configured. Currently supports 'TOTP' (Time-based One-Time Password).
      - `two_factor_type` string, required — Indicates whether the user has an active TOTP device configured. If false, the user must register a device before using MFA authentication.
      - `has_active_device` boolean, required — Indicates whether the user already has an active TOTP device configured. If false, the user needs to set up a new device before using MFA authentication.
      - `response_type` 'MFAToken', required — Discriminator field for LoginResponse
  - `state` string

## Other responses

- `400` — Validation Error
- `401` — Authentication Failed
- `403` — Permission Denied
- `404` — Not Found
- `405` — Method Not Allowed
- `406` — Not Acceptable
- `429` — Throttled
- `500` — Internal Server Error

---

[API](https://skmtc.dev/azion/apis/azion-api.md) · [All operations](https://skmtc.dev/azion/apis/azion-api/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/azion/azion-api/revisions/bb3250697218/schema)