Auth
Log in with email + password
Sets the JWT access-token cookie and a rotating refresh-token cookie on success. Rate-limited to 10 requests/5min per IP, plus a per-(IP, email) brute-force gate (5 failures / 15min).
T731: when the account has CONFIRMED TOTP MFA, a correct password does NOT set session cookies. The 200 response instead carries AuthMfaChallengeResponse (mfaRequired: true + a short-lived challenge), and the caller must complete the session via POST /auth/login/mfa.
post/auth/login
Request
- Base URL: http://localhost:38200
- URL: http://localhost:38200/auth/login
- Auth: none required
Request body
Response
Either a completed session (JWT + refresh cookies set), or -- when the account has confirmed MFA -- an MFA challenge with no cookies set. Distinguish by the presence of mfaRequired.
Changes
No recorded changes to this operation across all 1 revision of this API.