---
title: "Login User"
method: POST
path: "/v1/users/auth/login"
tags: ["Users"]
---

# Login User

`POST /v1/users/auth/login`

## Request

- Base URL: `https://api.fettle.sh` (the document declares no server; this is the origin it was published from)
- URL: `https://api.fettle.sh/v1/users/auth/login`
- Auth: none declared

Authenticate user and return the access token.

The refresh token is delivered as an httpOnly cookie
(`refresh_token`, path `/v1/users/auth/login/refresh`, `SameSite=Lax`,
`Secure` in production) so SPA frontends can keep the access token in
memory while letting the browser handle refresh transport.

Requires a Cloudflare Turnstile token in the
`X-Turnstile-Token` header when bot protection is enabled.

## Headers

- `X-Turnstile-Token` string, nullable

## Request body

- LoginUserModel
  - `email` string, email, required
  - `password` string, required

## Response `200`

Successful Response

- AccessTokenResponseModel: Response body for login and refresh — refresh token lives in httpOnly cookie.
  - `access_token` string, required

## Other responses

- `422`: Validation Error

---

[API](https://skmtc.dev/fettle/apis/fettle-sh.md) · [All operations](https://skmtc.dev/fettle/apis/fettle-sh/llms.txt) · [OpenAPI document](https://skmtc.dev/fettle/apis/fettle-sh/revisions/f32c8a18606f?raw)