Session Authentication

Logging in

Changed on

In order to log a User in to a new Session, you must provide their credentials, in JSON format.

For security reasons, the only possible results are success or failure. No detail is provided upon failure.

Successful responses will come with an HTTP-Only, Secure-Only cookie. This cookie is primarily meant for use by the Central frontend, and we do not recommend relying upon it. It will only work on GET requests, and it will only work over HTTPS.

post/v1/sessions

Request

  • Base URL
    / (relative, and the document was published on a file host, not at the API’s origin)
  • URL
    /v1/sessions
  • Auth
    none declared

Request body

emailstring required

The User's full email address.

passwordstring required

The User's password.

Example request

{
  "email": "my.email.address@getodk.org",
  "password": "my.super.secure.password"
}

Response

OK

createdAtstring required

ISO date format

expiresAtstring required

ISO date format

tokenstring required

The bearer token associated with the session. It consists only of URL-safe characters, so it should never need any escaping.

Changes