---
title: "Login"
method: POST
path: "/auth/login"
tags: ["Auth"]
---

# Login

`POST /auth/login`

## Request

- Base URL: `https://orbitus.netcorecloud.com`
- URL: `https://orbitus.netcorecloud.com/auth/login`
- Auth: none required

Authenticate a user. Returns JWT access token and refresh token.
Rate limited to 5 attempts per IP per 5 minutes.

## Request body

- LoginRequest
  - `account_name` string, required: Client/workspace name from `client_details.clientname`.
  - `username` string: Username (provide either `username` or `email`).
  - `email` string, email: Alternative to `username`.
  - `password` string, password, required

## Response `200`

Login successful (or 2FA required).

- union
  - LoginResponse
    - `token` string: JWT access token (15-minute lifetime).
    - `refresh_token` string: Refresh token (7-day lifetime).
    - `refresh_expires_at` string, date-time
    - `client_id` integer
    - `clients` ClientSummary[]
      - `client_id` integer
      - `clientname` string
      - `status` 'active' | 'inactive'
    - `is_parent` boolean
    - `user` UserProfile
      - `id` integer
      - `username` string
      - `email` string, email
      - `full_name` string
      - `role` 'admin' | 'viewer'
      - `client_id` integer
      - `two_factor_enabled` boolean
  - TwoFactorRequiredResponse
    - `two_factor_required` boolean
    - `user_id` integer
    - `client_id` integer

## Other responses

- `400`: Missing required fields.
- `401`: Invalid credentials.
- `429`: Rate limited.

---

[API](https://skmtc.dev/netcorecloud/apis/orbit-router.md) - [All operations](https://skmtc.dev/netcorecloud/apis/orbit-router/llms.txt) - [OpenAPI document](https://skmtc.dev/netcorecloud/apis/orbit-router/revisions/680f0a8ab1a3?raw)