auth

Login

Login with email and password.

Sets HttpOnly session + refresh cookies AND returns the access token in the JSON body for non-cookie clients (Badge SDK, curl). See module docstring for the cookie attribute set.

Lockout is enforced via Redis (PR-F #2 / HIGH #8, per account since #1414). Failed attempts increment a counter keyed on the normalised email (any address) and two keyed on source_ip (any account). AUTH_LOCKOUT_THRESHOLD (5) on the account or AUTH_LOCKOUT_IP_THRESHOLD (50) on the address within 15 minutes, or AUTH_LOCKOUT_IP_HOURLY_THRESHOLD (150) on the address within an hour, returns 429, with the same body every time. Successful login, or a completed password reset, clears the account counter only.

Fail-closed: if Redis is unavailable, return 503 — never silently allow login. Unlike the general rate limiter (which fails open by design — it's a guard rail), this IS the auth correctness boundary.

post/api/v1/auth/login

Request

  • Base URL: https://api.badgeia.com
  • URL: https://api.badgeia.com/api/v1/auth/login
  • Auth: none declared

Request body

emailstring email required
passwordstring required

Response

Successful Response

access_tokenstring required
token_typestring

Example response

{
  "user": {
    "email": "user@example.com"
  }
}

Changes

No recorded changes to this operation across all 1 revision of this API.