---
title: "Log in"
method: POST
path: "/v1/auth/login"
tags: ["Auth"]
---

# Log in

`POST /v1/auth/login`

## Request

- Base URL: `https://api.briefgate.dev`
- URL: `https://api.briefgate.dev/v1/auth/login`
- Auth: none required

Authenticate with email and password. Sets a session cookie — UNLESS the account has a second factor enabled, in which case the response carries `mfa_required` and a challenge instead, and no cookie is set until POST /v1/auth/2fa/verify succeeds.

## Request body

- Login
  - `email` string, email, required
  - `password` string, required

## Response `200`

Either a session, or a second-factor challenge

- union
  - object
    - `user` object
      - `id` string
      - `email` string, email
      - `name` string, nullable
      - `role` 'owner' | 'member'
    - `account` object
      - `id` string
      - `name` string
      - `tier` 'free' | 'solo' | 'studio' | 'agency'
  - object
    - `mfa_required` true, required
    - `challenge` string, required: Single-use, expires in five minutes.
    - `next` string

## Other responses

- `400`: Invalid request — malformed body or query parameters
- `401`: Wrong email or password
- `429`: Rate limit exceeded

---

[API](https://skmtc.dev/briefgate/apis/briefgate-api.md) · [All operations](https://skmtc.dev/briefgate/apis/briefgate-api/llms.txt) · [OpenAPI document](https://skmtc.dev/briefgate/apis/briefgate-api/revisions/b21afed4748b?raw)