---
title: "Start the WorkOS AuthKit login flow."
method: GET
path: "/auth/login"
tags: ["auth"]
---

# Start the WorkOS AuthKit login flow.

`GET /auth/login`

## Request

- Base URL: `http://localhost:8080`
- URL: `http://localhost:8080/auth/login`
- Auth: none required

Sets a short-lived CSRF state cookie and redirects (302) to WorkOS AuthKit. On success
WorkOS redirects back to `/auth/callback`. Browser-only — not for programmatic clients.

Mode-conditional: when no dvt-owned session flow is configured — snowflake mode, where
SPCS ingress authenticates every request off an identity header, and local dev with auth
disabled — no WorkOS handler is mounted and this path answers `303` to the SPA root
instead, so a bookmark or stale tab lands back in the app rather than on a JSON 404
(DVT-3463). No session is created either way. `/auth/callback` is deliberately NOT
mounted in that branch: there is no flow to complete, and a silent redirect there would
mask a genuine redirect-URI misconfiguration.

## Other responses

- `302`: Redirect to the WorkOS AuthKit authorization URL.
- `303`: No dvt-owned login flow is mounted (snowflake mode or auth-disabled dev); redirect to the SPA root.
- `429`: Per-actor API rate limit exceeded (SEC-2). All authenticated `/v1` routes apply a per-actor fixed-window default tier; selected compute-heavy routes (connection tests, column describe, data export) apply an additional tighter tier. Auth endpoints apply a per-IP tier. Problem type: `https://docs.dvt.dev/errors/rate-limited`. Wait for the `Retry-After` response header value (seconds) before retrying.

---

[API](https://skmtc.dev/dvt/apis/dvt-rest-api.md) · [All operations](https://skmtc.dev/dvt/apis/dvt-rest-api/llms.txt) · [OpenAPI document](https://skmtc.dev/dvt/apis/dvt-rest-api/revisions/00016f504165?raw)