---
title: "Log into the account"
method: POST
path: "/v3/accounts/login"
tags: ["Authentication"]
---

# Log into the account

`POST /v3/accounts/login`

Returns an access token and the refresh token.

## Headers

- `origin` string
- `user-Agent` string

## Request body

- UserLoginRequestModel — Customer (end user) login. Separate from the admin login model because only a `User` is environment-scoped — a team member's environment comes from their grants, never the request.
  - `accountId` string, nullable, required — Unique identifier of the account.
  - `accountAlias` string, nullable — Unique account alias.
  - `email` string, email, required — Email address of the user.
  - `password` string, required — Password of the user.
  - `twoFactorCode` string, nullable — Two factor code generated by Authenticator app.
  - `twoFactorRecoveryCode` string, nullable — Two factor recovery code.
  - `rememberMe` boolean, required — Remember me. When true, the refresh token is valid for 7 days instead of 1 day.
  - `environmentId` string, uuid, nullable — Environment the user belongs to; null means production. SDK transport (the `eid` from product.dat), which is how a named-user license authenticates inside a sandbox — not a documented knob. Rejected for browser sessions: the customer portal is production-only.

## Response `200`

OK

- AccessTokenDto
  - `accessToken` string, required
  - `refreshToken` string, required

## Other responses

- `400` — Bad Request
- `409` — Conflict
- `429` — Too Many Requests
- `500` — Server Error

## Changes

- **2026-09-25** `a25b6aaa706c` — 1 info
  - added the new optional request property `environmentId`

[Change history](https://skmtc.dev/cryptlex/apis/cryptlex-web-api/changes/v3/accounts/login/post.md)

---

[API](https://skmtc.dev/cryptlex/apis/cryptlex-web-api.md) · [All operations](https://skmtc.dev/cryptlex/apis/cryptlex-web-api/llms.txt) · [OpenAPI document](https://skmtc.dev/cryptlex/apis/cryptlex-web-api/revisions/a25b6aaa706c?raw)