---
title: "Sign a user in and receive a session token (JWT) for subsequent calls."
method: POST
path: "/v1/login"
tags: ["Authentication"]
---

# Sign a user in and receive a session token (JWT) for subsequent calls.

`POST /v1/login`

## Request

- Base URL: `https://partner.mindupload.app`
- URL: `https://partner.mindupload.app/v1/login`
- Auth: API key in header `X-Partner-Key`

## Request body

- object
  - `preferred_language` string, nullable: BCP-47-ish language code (e.g. 'en', 'zh-cn') for localized messages.
  - `username` string, nullable: The end-user's username.
  - `password` string, nullable: The end-user's password on first sign-in. After login/register, send the returned session token (JWT) here instead — the field accepts either, and reusing the token keeps raw passwords out of your storage.
  - `visitor_id` string, nullable: Optional. A stable identifier for the device or app install signing in. Send the same value every time from one install: a new sign-in then replaces only the earlier session of that install and leaves the other devices of the user signed in.

## Response `200`

Result envelope — check the success field.

- object
  - `success` boolean: Whether the call succeeded.
  - `error_message` string, nullable: Human-readable reason when success is false.
  - `error_code` string
  - `jwt` string, nullable
  - `decrypted_user` object, nullable

## Other responses

- `400`: Invalid request payload.
- `401`: Missing or invalid partner key.
- `403`: Partner is not authorized for this operation.
- `429`: Rate limit exceeded — retry later.
- `500`: Internal server error.

---

[API](https://skmtc.dev/mindupload/apis/mind-upload-partner-api.md) · [All operations](https://skmtc.dev/mindupload/apis/mind-upload-partner-api/llms.txt) · [OpenAPI document](https://skmtc.dev/mindupload/apis/mind-upload-partner-api/revisions/0371bdf78533?raw)