---
title: "🛡️ Log into a Cardinal app."
method: POST
path: "/api/v1/auth/login"
tags: ["Authentication"]
---

# 🛡️ Log into a Cardinal app.

`POST /api/v1/auth/login`

Logs the user into a client application that is hosted (bundled web app) or served by this server.

If logging into the Guest Account, no credentials are required. If logging into a Cardinal Account, a valid Cardinal SSO token is required.

The client app <strong>must</strong> set the <code>cardinal-app</code> header for this request.

Only the capability corresponding to the application that you are trying to log into will be validated.<br /><hr /><h3>🛡️ Requires one of these Capabilities: <code>AdminApp.Login</code> <code>MusicApp.Login</code> <code>PhotosApp.Login</code> <code>CinemaApp.Login</code></h3>

## Headers

- `cardinal-app` 'admin' | 'music' | 'photos' | 'cinema'

## Request body

- LoginDetails
  - `userId` string
  - `username` string
  - `password` string
  - `cardinalJWT` string

## Response `201`

- LoginResponse
  - `JWT` string, required
  - `user` object, required
  - `cloudJWT` string
  - `cloudUser` object
  - `refreshToken` string
  - `scope` object

## Other responses

- `401` — Returns a 401 if there is an issue with the SSO token.

## Changes

- **2026-04-23** `fd25cc21a89e` — 1 warning, 2 info
  - removed the optional property `refreshTolkien` from the response with the `201` status
  - added the optional property `refreshToken` to the response with the `201` status
  - added the optional property `scope` to the response with the `201` status
- **2026-04-23** `503a10ab48c2` — 1 info
  - endpoint added
- **2026-03-10** `1ec5a2e9d039` — 1 breaking
  - api path removed without deprecation

[Change history](https://skmtc.dev/cardinalapps/apis/cardinal-media-server-api/changes/api/v1/auth/login/post.md)

---

[API](https://skmtc.dev/cardinalapps/apis/cardinal-media-server-api.md) · [All operations](https://skmtc.dev/cardinalapps/apis/cardinal-media-server-api/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/cardinalapps/cardinal-media-server-api/revisions/7b5e4555e84f/schema)