---
title: "Login to an existing account"
method: POST
path: "/login"
tags: ["Authentication"]
---

# Login to an existing account

`POST /login`

Authenticates with email and password, returning a new API key. Login generates a new API key each time, replacing any existing key. Store the key securely. Accounts with two-factor authentication enabled must generate an API key from the web UI instead. Rate limited to 5 attempts per IP per 15 minutes.

## Request body

- object
  - `email` string, email, required — Account email address
  - `password` string, required — Account password

## Response `200`

Login successful

- object
  - `data` object
    - `api_key` string — New API key for authenticating future requests. Store this securely.
    - `user` object
      - `id` integer — User ID
      - `name` string — User's full name
      - `email` string, email — User's email address

## Other responses

- `401` — Invalid email or password
- `403` — Account has two-factor authentication enabled
- `422` — Validation error
- `429` — Too many login attempts

## Changes

- **2026-02-11** `36ccba39bc4d` — 1 breaking, 1 warning, 2 info
  - the `data/user/id` response's property type changed from `string` to `integer` for status `200`
  - removed the optional property `data/api_key_expires_at` from the response with the `200` status
  - api operation id `login` removed and replaced with ``
  - removed the non-success response with the status `409`

[Change history](https://skmtc.dev/eventschedule/apis/event-schedule-api/changes/login/post.md)

---

[API](https://skmtc.dev/eventschedule/apis/event-schedule-api.md) · [All operations](https://skmtc.dev/eventschedule/apis/event-schedule-api/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/eventschedule/event-schedule-api/revisions/36ccba39bc4d/schema)