Users
Auth

Authenticate and issue a session cookie

Accepts email + password. On success, mints a session JWT and sets it as an httpOnly + SameSite=Lax cookie. Returns the user profile. Login does NOT require verified email (soft-lock). Suppressed emails (hard-bounced / complained / manually blocked) are rejected with the same generic 401 as wrong credentials — no enumeration signal. Failures use a generic "Invalid credentials" message regardless of whether the email exists or the password was wrong.

post/api/v1/users/auth/login

Request

  • Base URL: https://api.juju.com
  • URL: https://api.juju.com/api/v1/users/auth/login
  • Auth: none declared

Request body

emailstring email required
passwordstring required

Example request

{
  "email": "jed@example.com",
  "password": "correct-horse-battery-staple"
}

Response

Login succeeded. Session cookie set on the response.

metaobject required

Pagination and context metadata. Always present, empty object ({}) when no metadata applies to the response.

errorsstring[] required

Empty array on success. On failure, human-readable error strings suitable for surfacing to end users.

Example response

{
  "errors": []
}

Changes

No recorded changes to this operation across all 1 revision of this API.