---
title: "Login"
method: POST
path: "/auth/login"
tags: ["auth"]
---

# Login

`POST /auth/login`

## Request

- Base URL: `https://api.getathly.com` (the document declares no server; this is the origin it was published from)
- URL: `https://api.getathly.com/auth/login`
- Auth: none declared

Sign in with email and password. Returns a Supabase session.

Throttled from the same password-attempt budget as ``/onboarding/signup``,
spent only by wrong credentials, so a correct sign-in is never slowed. A
valid ``device_token`` (issued with every successful sign-in) moves the
attempt onto that device's own budget, so guesses from elsewhere cannot
lock the owner out.

## Request body

- LoginRequest
  - `email` string, email, required
  - `password` string, required
  - `device_token` string, nullable

## Response `200`

Successful Response

- LoginResponse
  - `access_token` string, required
  - `refresh_token` string, required
  - `expires_at` integer, required
  - `user_id` string, required
  - `device_token` string, required

## Other responses

- `422`: Validation Error

---

[API](https://skmtc.dev/getathly/apis/athly-api.md) - [All operations](https://skmtc.dev/getathly/apis/athly-api/llms.txt) - [OpenAPI document](https://skmtc.dev/getathly/apis/athly-api/revisions/6adfdc258d75?raw)