---
title: "Login with the Privy access token"
method: POST
path: "/auth/login"
tags: ["auth"]
---

# Login with the Privy access token

`POST /auth/login`

Accepts the token from the `privy-token` cookie or an `Authorization: Bearer` header. The cookie takes precedence; the bearer header is a permanent path for mobile and the admin app. The body is the `GET /auth/session` payload, plus `jwt` for bearer clients.

## Headers

- `x-dre-auth-mode` string

## Request body

- LoginDto

## Response `200`

Login successful

- LoginResponseDto
  - `id` number, required — DRE user id
  - `wallet` string, required — Wallet address this session is bound to
  - `roles` number[], required — Role ids held by the user
  - `status` 'active' | 'profile_required' | 'beta_required', required — Which gate the user is behind. `profile_required` takes precedence over `beta_required`.
  - `jwt` string — JWT for bearer clients (mobile, admin). Omitted for cookie clients.

## Other responses

- `401` — Unauthorized
- `403` — Origin not allowed or blocked Sec-Fetch-Site

---

[API](https://skmtc.dev/dre/apis/dre-api.md) · [All operations](https://skmtc.dev/dre/apis/dre-api/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/dre/dre-api/revisions/5d14beb9482b/schema)