---
title: "Login to an existing account"
method: POST
path: "/login"
tags: ["Authentication"]
---

# Login to an existing account

`POST /login`

Authenticates with email and password, returning a new API key. If an active API key already exists, returns a 409 error - disable and re-enable API access in account settings to generate a new key. Store the key securely. Accounts with two-factor authentication enabled must generate an API key from the web UI instead. Rate limited to 5 attempts per IP per 15 minutes.

## Request body

- object
  - `email` string, email, required — Account email address
  - `password` string, required — Account password

## Response `200`

Login successful

- object
  - `data` object
    - `api_key` string — New API key for authenticating future requests. Store this securely.
    - `api_key_expires_at` string, date-time — ISO 8601 timestamp when the API key expires
    - `user` object
      - `id` string — Encoded user ID
      - `name` string — User's full name
      - `email` string, email — User's email address

## Other responses

- `401` — Invalid email or password
- `403` — Account has two-factor authentication enabled
- `409` — An active API key already exists
- `422` — Validation error
- `429` — Too many login attempts

## Changes

- **2026-02-12** `a8b2457d1944` — 1 info
  - added the non-success response with the status `409`
- **2026-02-12** `ff731685d630` — 1 info
  - added the optional property `data/api_key_expires_at` to the response with the `200` status
- **2026-02-12** `2596baa89e80` — 1 breaking
  - the `data/user/id` response's property type changed from `integer` to `string` for status `200`
- **2026-02-11** `e24c8532211b` — 1 info
  - api operation id `login` was added
- **2026-02-11** `36ccba39bc4d` — 1 breaking, 1 warning, 2 info
  - the `data/user/id` response's property type changed from `string` to `integer` for status `200`
  - removed the optional property `data/api_key_expires_at` from the response with the `200` status
  - api operation id `login` removed and replaced with ``
  - removed the non-success response with the status `409`

[Change history](https://skmtc.dev/eventschedule/apis/event-schedule-api/changes/login/post.md)

---

[API](https://skmtc.dev/eventschedule/apis/event-schedule-api.md) · [All operations](https://skmtc.dev/eventschedule/apis/event-schedule-api/llms.txt) · [OpenAPI document](https://skmtc.dev/eventschedule/apis/event-schedule-api/revisions/37529a7e8800?raw)