---
title: "Login to an existing account"
method: POST
path: "/login"
tags: ["Authentication"]
---

# Login to an existing account

`POST /login`

Authenticates with email and password, returning a new API key. If an active API key already exists, returns a 409 error - disable and re-enable API access in account settings to generate a new key. Store the key securely. Accounts with two-factor authentication enabled must generate an API key from the web UI instead. Rate limited to 5 attempts per IP per 15 minutes.

## Request body

- object
  - `email` string, email, required — Account email address
  - `password` string, required — Account password

## Response `200`

Login successful

- object
  - `data` object
    - `api_key` string — New API key for authenticating future requests. Store this securely.
    - `api_key_expires_at` string, date-time — ISO 8601 timestamp when the API key expires
    - `user` object
      - `id` string — Encoded user ID
      - `name` string — User's full name
      - `email` string, email — User's email address

## Other responses

- `401` — Invalid email or password
- `403` — Account has two-factor authentication enabled
- `409` — An active API key already exists
- `422` — Validation error
- `429` — Too many login attempts

---

[API](https://skmtc.dev/eventschedule/apis/event-schedule-api.md) · [All operations](https://skmtc.dev/eventschedule/apis/event-schedule-api/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/eventschedule/event-schedule-api/revisions/fc24d7d227c4/schema)