---
title: "Authenticate user with password"
method: POST
path: "/resources/auth/v1/user"
tags: ["General"]
---

# Authenticate user with password

`POST /resources/auth/v1/user`

## Request

- Base URL: `http://localhost:8181`
- URL: `http://localhost:8181/resources/auth/v1/user`
- Auth: HTTP bearer
- TypeScript: <https://skmtc.dev/frontegg/apis/entitlements-agent-pdp/docs/resources/auth/v1/user/post.ts> (a function with typed inputs; its response is checked against the schema)

This route authenticates a local user using email and password. Send the **`frontegg-vendor-host`** as a header to declare which vendor. This is your domain name in the Frontegg Portal ➜ Workspace Settings ➜ Domains ➜ Domain Name. Optionally, send login information for the user as POST body params. Include the invitation token if the user is signing up by invitation. Send the recaptcha token if the recaptcha is enabled for login.

## Headers

- `frontegg-vendor-host` string

## Request body

- AuthenticateUserPasswordDto
  - `email` string, required
  - `password` string, required
  - `recaptchaToken` string
  - `invitationToken` string

## Response `200`

- AuthenticationResponseDto
  - `tokenType` string
  - `mfaRequired` boolean, required
  - `mfaToken` string
  - `mfaEnrolled` boolean
  - `mfaDevices` UserMFADevicesResponse
    - `webauthn` UserMFAWebAuthnDeviceResponse[], required
      - `id` string, required
      - `deviceType` 'Platform' | 'CrossPlatform', required
      - `name` string, required
    - `phones` UserMFAPhoneDeviceResponse[], required
      - `id` string, required
      - `phoneNumber` string, required
    - `authenticators` UserMFAAuthenticatorAppResponse[], required
      - `id` string, required
    - `emails` UserMFAEmailCodeResponse[], required
      - `email` string, required
  - `mfaStrategies` object
  - `qrCode` string
  - `recoveryCode` string
  - `accessToken` string, required
  - `refreshToken` string, required
  - `expiresIn` number, required
  - `expires` string, required
  - `userId` string
  - `userEmail` string
  - `emailVerified` boolean
  - `isBreachedPassword` boolean

---

[API](https://skmtc.dev/frontegg/apis/entitlements-agent-pdp.md) - [All operations](https://skmtc.dev/frontegg/apis/entitlements-agent-pdp/llms.txt) - [OpenAPI document](https://skmtc.dev/frontegg/apis/entitlements-agent-pdp/revisions/c496ae9e1c3e?raw)