---
title: "Login local owner account"
method: POST
path: "/auth/login"
---

# Login local owner account

`POST /auth/login`

## Request

- Base URL: `https://api.eurobase.dev`
- URL: `https://api.eurobase.dev/auth/login`
- Auth: none declared

Creates a PostgreSQL-clocked 35-day browser session and returns the authenticated identity. Browser session state is established by Set-Cookie, not a JSON bearer token.

## Headers

- `idempotency-key` string

## Request body

- AuthCredentialsRequest
  - `email` string, required
  - `password` string, required
  - `authChallenge` string: ADR 0088: base64 JSON {algorithm, challenge, number, salt, signature} solving a challenge this client received for this action; valid once within five minutes. Accepted in the JSON body of every step-up route.

## Response `200`

Logged in

- AuthResponse
  - `user` AuthUser, required
    - `id` string, required
    - `email` string, required
    - `status` string, nullable
    - `deleteRequestedAt` string, date-time, nullable
    - `deletionState` 'billing_pending' | 'cleanup_pending' | 'null', nullable
    - `emailVerifiedAt` string, date-time, nullable
    - `emailVerified` boolean, required
    - `authAccessState` 'verified' | 'email_verification_required', required
    - `avatarUrl` string, nullable, required: Profile picture of the most recently used linked Google or GitHub sign-in that has one.
    - `createdAt` string, date-time, required
  - `authAccessState` 'verified' | 'email_verification_required', required
  - `emailVerification` object, required
    - `required` boolean, required
    - `verified` boolean, required
    - `sent` boolean, required
  - `capabilities` SessionCapabilities, required
    - `operator` boolean, required
    - `ownerOperator` boolean, required
  - `clientIp` string, nullable, required

## Other responses

- `400`: Malformed email rejected
- `409`: The account still holds a retired pre-v2 password hash (ADR 0092). The password is not verified; the API has emailed a password reset link under the per-email reset limit, and no session is created
- `429`: Auth step-up (ADR 0088, amended 2026-10-18): when the client or the account from this client is past its failed-attempt threshold, every login, correct password or not, must carry a solved challenge before the password is checked (auth-challenge-required); past the ceiling the challenge is the hardest one and a login is never refused. Retain idempotency-key and resubmit the same body with authChallenge
- `503`: Password hashing capacity is busy, for everyone or for this client address (Retry-After: 2), or the client address could not be proven: in hosted mode password login is accepted only through the Web (ADR 0086); retry without losing entered input

---

[API](https://skmtc.dev/eurobase/apis/eurobase-api.md) · [All operations](https://skmtc.dev/eurobase/apis/eurobase-api/llms.txt) · [OpenAPI document](https://skmtc.dev/eurobase/apis/eurobase-api/revisions/5266a299d18a?raw)