---
title: "Logging in"
method: POST
path: "/v1/sessions"
tags: ["Session Authentication"]
---

# Logging in

`POST /v1/sessions`

In order to log a `User` in to a new `Session`, you must provide their credentials, in JSON format.

For security reasons, the only possible results are success or failure. No detail is provided upon failure.

Successful responses will come with an HTTP-Only, Secure-Only cookie. This cookie is primarily meant for use by the Central frontend, and we do not recommend relying upon it. It will only work on `GET` requests, and it will only work over HTTPS.

## Request body

- object
  - `email` string, required — The `User`'s full email address.
  - `password` string, required — The `User`'s password.

## Response `200`

OK

- object
  - `createdAt` string, required — ISO date format
  - `expiresAt` string, required — ISO date format
  - `token` string, required — The bearer token associated with the session. It consists only of URL-safe characters, so it should never need any escaping.

## Changes

- **2025-12-20** `022694254f0d` — 1 info
  - api operation id `Logging in` removed and replaced with `logIn`
- **2025-10-27** `b11b54eea487` — 1 info
  - removed the non-success response with the status `401`
- **2025-03-13** `e8c2858fd4eb` — 2 info
  - api operation id `logIn` removed and replaced with `Logging in`
  - added the non-success response with the status `401`

[Change history](https://skmtc.dev/getodk/apis/odk-central-api/changes/v1/sessions/post.md)

---

[API](https://skmtc.dev/getodk/apis/odk-central-api.md) · [All operations](https://skmtc.dev/getodk/apis/odk-central-api/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/getodk/odk-central-api/revisions/d4f5ba77f644/schema)