---
title: "Create login"
method: POST
path: "/logins"
tags: ["Logins"]
---

# Create login

`POST /logins`

Logins can be of either type `device` or `api`.

Logins of type `device` represent logins from a computer, phone, etc. They contain
device information such as `device_brand`, `device_model` and `os_name`. Users can
create device logins for themselves when password flow is enabled; for organization owners,
password flow is always enabled.
Users with an organization-scoped role containing the `logins_write`
permission can create device logins for *other* users, provided those users do not have
greater permissions than the creator.
Users can have up to 40 device logins. When the limit
is exceeded, the least recently used or oldest login will be removed.

Logins of type `api` represent logins used by third party applications and integrations.
Users can have up to 10 API logins. When the limit is exceeded, creation will fail.

## Request body

- object
  - `login` object, required — Information about the login being created.
    - `type` 'api' | 'device' — The type of the login.
    - `name` string, nullable — The name for the login.
    - `device_brand` string, nullable — The brand of the device.
    - `device_model` string, nullable — The model of the device.
    - `device_uid` string, nullable — The uid of the device. This field is experimental and may change.
    - `os_name` string, nullable — The name of the OS.
    - `push_token` string — The push token of the login.
    - `ios_voip_push_token` string — Voice over IP push token for iOS devices..
    - `email` string, email — The email of the user to create the login for. We do not allow creating API logins on behalf of other users. Only logins with `type` set to `device` can be created on behalf of other users.
    - `expire` boolean — Whether the login expires.
  - `user` object, required — Authentication information about the user making the request to create a login.
    - `domain` string — The domain of the organization of the user. Required when signing in with password.
    - `email` string — The email of the user. Required when signing in with password.
    - `password` string — The password of the user. Required when signing in with password.
    - `authentication_info` string — An authentication info token. Can be used as a substitute for domain, email and password.
    - `otp_attempt` string — A one time password. Required when two factor authentication is turned on.

## Response `200`

OK

- object
  - `id` integer, required — The ID of the login
  - `created_at` string, date-time, required — When the login was created
  - `updated_at` string, date-time, required — When the login was updated
  - `type` 'api' | 'device', required — The type of the login.
  - `name` string, nullable, required — The name for the login.
  - `primary` boolean, required — Whether the login is the primary login.
  - `expire` boolean, required — Whether the login expires.
  - `last_used_at` string, date-time, nullable, required — When the login was last used.
  - `device_brand` string, nullable, required — The brand of the device.
  - `device_model` string, nullable, required — The model of the device.
  - `os_name` string, nullable, required — The name of the OS.
  - `user_id` integer, required — The user ID of the login
  - `user` object, required — The user of the login
    - `id` integer, required — The ID of the user
    - `resource_type` 'User', required — The resource type of the user
    - `email` string, email, required — The email of the user.
    - `name` string, required — The name of the user
  - `app` object, required
    - `name` string, nullable
    - `version` string, nullable
  - `user_agent` object, required
    - `name` string, nullable
    - `version` string, nullable
  - `device` object, required
    - `brand` string, nullable
    - `model` string, nullable
  - `os` object, required
    - `name` string, nullable
    - `version` string, nullable
  - `scram_credentials` object, nullable, required
    - `phone_key` string, hex
    - `online_certificate` string, hex
  - `secret` string, required — The secret value used for authentication. Returned when creating API logins; Returned for device logins when resolving and creating logins.
  - `authentication_token` string, required — Alias for secret
  - `has_primary_device` boolean, required — Whether the user has a primary device.
  - `email` string, email, required — The email of the user.
  - `notifications_unread_count` integer, required — The count of unread notifications.
  - `otp_required_for_login` boolean, required — Whether OTP/2FA is required for login.
  - `otp_enabled_at` string, date-time, nullable, required — When was the OTP/2FA enabled.
  - `image` string, uri, nullable, required — The url to the image of the user.
  - `primary_login_exists` boolean, required — Whether the user has a primary login.

## Other responses

- `401` — Unauthorized
- `403` — Forbidden
- `404` — Not Found

---

[API](https://skmtc.dev/kisi/apis/kisi-api.md) · [All operations](https://skmtc.dev/kisi/apis/kisi-api/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/kisi/kisi-api/revisions/998700ffff5a/schema)