---
title: "Authenticate and obtain a JWT"
method: POST
path: "/eclipse-conductor/rest/v1/authentication/login"
tags: ["a) Authentication"]
---

# Authenticate and obtain a JWT

`POST /eclipse-conductor/rest/v1/authentication/login`

Authenticates an identity and password (plus optional PKI challenge response) and returns a JWT. Store the expiry and renew before it lapses — requests with expired tokens return HTTP 401.

## Request body

- EclipseAuthCredentials — A username/password (and optional challenge response for WebAuthN/PKI auth) and/or TOTP for getting a valid JWT
  - `base64EncodedChallengeHash` string — Optional: Needed when identity has a public key or responding to a WebAuthN challenge
  - `base64EncodedChallengeResponse` string — Optional: Needed when identity has a public key or responding to a WebAuthN challenge
  - `deviceFingerprint` string
  - `identity` string, required — Identity/username for authentication
  - `otp` string — Optional: Needed when wanted to impersonate users with otp by a currently authenticated user - the currently authenticated user must contain a position for allowing impersonation. Also required if device fingerprinting is enabled on the tenant and the fingerprint is not enrolled
  - `password` string, required — Can be pre-hashed with BCRYPT or passed as clear text in which case Eclipse will hash it
  - `scope` string[] — Optional: Request a deliberately down-scoped JWT for the currently-authenticated identity (self-scoping). Requires an existing Authorization header. The only permitted scope is 'UpdateByTasks', which forces all subsequent mutating requests (POST/PUT/DELETE/PATCH) through the task-submission workflow.
  - `securityQuestionAnswers` SecurityQuestionAnswer[] — Optional: Needed if the customer has security questions
    - `answer` string — The answer to the question id. Will not be case sensitive
    - `securityQuestionId` integer — Unique id for the security question
  - `totp` string — Optional: Needed when identity has MFA enabled. This is the time based OTP for the identity

## Response `200`

OK

- Jwt
  - `csrfHeaderName` string
  - `csrfToken` string
  - `expires` string, date-time — The date and time the JWT expires and should be refreshed before
  - `expiresEpochSecs` integer
  - `headerName` string — The HTTP header name to use in order to pass the JWT as the bearer token. E.g. Authorization
  - `headerValue` string — The HTTP header value to use in order to pass the JWT as the bearer token. E.g. Bearer AAAA...
  - `refreshToken` string
  - `roles` string[] — The roles this login is associated with
  - `sessionId` string — A unique identifier for this login session. Typiclaly not needed by the caller
  - `tenantId` integer — The tenant ID associated with these credentials. Optional as some identities are global and not associated to any specific tenant

## Other responses

- `400` — Bad Request
- `401` — Unauthorized - invalid credentials or expired challenge
- `500` — Internal Server Error

---

[API](https://skmtc.dev/eftcorp/apis/eclipse-rest-api.md) · [All operations](https://skmtc.dev/eftcorp/apis/eclipse-rest-api/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/eftcorp/eclipse-rest-api/revisions/9213d52d49a3/schema)