---
title: "CLI password login — returns bearer tokens in JSON body"
method: POST
path: "/auth/login"
tags: ["Auth"]
---

# CLI password login — returns bearer tokens in JSON body

`POST /auth/login`

## Request

- Base URL: `https://api.mnemom.ai/v1`
- URL: `https://api.mnemom.ai/v1/auth/login`
- Auth: none required

Legacy CLI-targeted endpoint. Unlike `/auth/sign-in`, this does NOT set cookies — it returns access + refresh tokens in the JSON body for the CLI to persist at `~/.mnemom/auth.json`. For users with a ready TOTP factor the password alone does not mint tokens: the response is 200 `{ mfa_required: true, factor_id }` and no token pair is issued (aal2 step-up, #60). For an email whose domain belongs to an org that enforces SSO this returns 403 `sso_required` (use SSO, e.g. `mnemom login`); if that enforcement check cannot be completed it returns 503 `sso_check_unavailable` rather than proceed (fail-closed). Rate-limited.

## Request body

- object
  - `email` string, email, required
  - `password` string, password, required

## Response `200`

Tokens returned OR MFA step-up required.

- union
  - object
    - `access_token` string, required
    - `refresh_token` string, required
    - `expires_in` integer
    - `user` User: Supabase user shape. Fields beyond `id` and `email` are passthrough.
      - `id` string, uuid
      - `email` string, email
      - `app_metadata` object
      - `user_metadata` object
  - object
    - `mfa_required` true, required
    - `factor_id` string, required
    - `mfa_token` string, required: Opaque, sealed, single-use step-up handle. Submit to `POST /auth/login/mfa` with the TOTP code to complete login. 10-minute TTL.

## Other responses

- `400`: Bad request
- `401`: Authentication required
- `403`: Forbidden
- `429`: Rate-limit exceeded. The global per-IP limiter (100 requests/minute, applied to every `/v1/*` route) rejected this request. Back off until the window resets — `Retry-After` carries the cooldown in seconds and `X-RateLimit-Reset` the absolute reset time.
- `500`: Server error — request was well-formed but the server failed to fulfill it. Typically a downstream dependency (DB / RPC / external API) returned an unexpected error.
- `502`: An upstream dependency returned an invalid response.
- `503`: An upstream dependency is currently unavailable. The request was not processed; retry after the cooldown window.

---

[API](https://skmtc.dev/mnemom/apis/mnemom-api.md) · [All operations](https://skmtc.dev/mnemom/apis/mnemom-api/llms.txt) · [OpenAPI document](https://skmtc.dev/mnemom/apis/mnemom-api/revisions/274b7a6ea182?raw)