---
title: "Sign in and get tokens"
method: POST
path: "/signin"
tags: ["Authentication"]
---

# Sign in and get tokens

`POST /signin`

## Request

- Base URL: `https://api.indexone.io`
- URL: `https://api.indexone.io/signin`
- Auth: API key in header `x-api-key`

Authenticates against Cognito using the `USER_PASSWORD_AUTH` flow and returns an id token plus a refresh token.

Send `id_token` as the `Authorization` header on every authenticated request — **raw, with no `Bearer ` prefix**. It expires after `expires_in` seconds (3600 by default); use `POST /refresh_token` to get a new one without re-prompting for the password.

## Request body

- object
  - `username` string, email, required: Lower-cased server-side, so case does not matter.
  - `password` string, required

## Response `200`

Authenticated.

- object
  - `id_token` string: Cognito id token (JWT). Send as `Authorization`, no prefix.
  - `refresh_token` string: Long-lived; exchange at `POST /refresh_token`.
  - `expires_in` integer: Lifetime of `id_token` in seconds.

## Other responses

- `401`: Authentication failed. The `code` carries the Cognito exception class: `NotAuthorizedException` for bad credentials, `UserNotConfirmedException` when `POST /signup/confirm` was never called, `UserNotFoundException` for an unknown address.
- `403`: Missing or invalid `x-api-key`.
- `429`: API key usage-plan rate limit exceeded.

---

[API](https://skmtc.dev/indexone/apis/index-one-rest-api.md) · [All operations](https://skmtc.dev/indexone/apis/index-one-rest-api/llms.txt) · [OpenAPI document](https://skmtc.dev/indexone/apis/index-one-rest-api/revisions/df5a92216a9c?raw)