---
title: "Create an opaque Web session"
method: POST
path: "/auth/login"
tags: ["Auth"]
---

# Create an opaque Web session

`POST /auth/login`

## Request

- Base URL: `https://api.flashdata.dev/v2`
- URL: `https://api.flashdata.dev/v2/auth/login`
- Auth: none required

Sets the Secure, HttpOnly `__Host-fd_session` cookie. Pending accounts
receive a restricted email_verification Session for the verification dashboard.
Eligible verified accounts receive their one-time Trial Credits on login if not already granted.
An active account
receives a full Session unless its migrated identity still requires a
current legal acceptance, in which case it receives a restricted
legal_acceptance Session. An account with a scheduled deletion request
receives a restricted deletion_recovery Session. Accounts whose deletion
is processing/failed/completed, and suspended accounts, receive 403.

## Request body

- LoginRequest
  - `email` string, email, required
  - `password` string, required
  - `rememberMe` boolean: Ignored for email_verification, legal_acceptance and deletion_recovery Sessions, which always use a short fixed expiry.

## Response `200`

Authenticated

- LoginResponse
  - `account` Account, required: Deleted accounts are only returned through authorized Admin projections; their identity fields are redacted.
    - `id` string, required
    - `name` string, required
    - `email` string, email, nullable, required
    - `status` 'pending_verification' | 'active' | 'suspended' | 'deleting' | 'deleted', required
    - `emailVerified` boolean, required
    - `legalAcceptanceRequired` boolean, required
    - `role` 'user' | 'admin', required
    - `timezone` string, required
    - `createdAt` string, date-time, required
    - `updatedAt` string, date-time, required
  - `csrfToken` string, required
  - `sessionMode` 'full' | 'email_verification' | 'legal_acceptance' | 'deletion_recovery', required

## Other responses

- `401`: Authentication required or invalid
- `403`: Login is forbidden; Problem.code is email_not_verified, account_suspended, account_deletion_processing, account_deletion_failed, or account_deleted
- `422`: Request validation failed
- `423`: Account temporarily locked
- `429`: Rate, concurrency, batch, or pending-job limit exceeded

---

[API](https://skmtc.dev/flashdata/apis/flashdata-customer-api.md) · [All operations](https://skmtc.dev/flashdata/apis/flashdata-customer-api/llms.txt) · [OpenAPI document](https://skmtc.dev/flashdata/apis/flashdata-customer-api/revisions/109179fe9313?raw)