---
title: "Sign in with email and password"
method: POST
path: "/signin/email-password"
tags: ["authentication"]
---

# Sign in with email and password

`POST /signin/email-password`

Authenticate a user with their email and password. Returns a session object or MFA challenge if two-factor authentication is enabled.

## Request body

- SignInEmailPasswordRequest — Request to authenticate using email and password
  - `email` string, email, required — User's email address
  - `password` string, required — User's password

## Response `200`

Authentication successful. If MFA is enabled, a challenge will be returned instead of a session.

- SignInEmailPasswordResponse — Response for email-password authentication that may include a session or MFA challenge
  - `session` Session — User authentication session containing tokens and user information
    - `accessToken` string, required — JWT token for authenticating API requests
    - `accessTokenExpiresIn` integer, required — Expiration time of the access token in seconds
    - `refreshTokenId` string, required — Identifier for the refresh token
    - `refreshToken` string, required — Token used to refresh the access token
    - `user` User — User profile and account information
      - `avatarUrl` string, required — URL to the user's profile picture
      - `createdAt` string, date-time, required — Timestamp when the user account was created
      - `defaultRole` string, required — Default authorization role for the user
      - `displayName` string, required — User's display name
      - `email` string, email — User's email address
      - `emailVerified` boolean, required — Whether the user's email has been verified
      - `id` string, required — Unique identifier for the user
      - `isAnonymous` boolean, required — Whether this is an anonymous user account
      - `locale` string, required — User's preferred locale (language code)
      - `metadata` object, required — Custom metadata associated with the user
      - `phoneNumber` string — User's phone number
      - `phoneNumberVerified` boolean, required — Whether the user's phone number has been verified
      - `roles` string[], required — List of roles assigned to the user
      - `activeMfaType` string, nullable — Active MFA type for the user
  - `mfa` MFAChallengePayload — Challenge payload for multi-factor authentication
    - `ticket` string, required — Ticket to use when completing the MFA challenge

## Other responses

- `default` — An error occurred while processing the request

## Changes

- **2026-06-24** `0fc5fd589dbf` — 1 warning
  - added the new `otp-too-many-attempts` enum value to the `error` response property for the response status `default`
- **2026-04-20** `b39086c84b43` — 1 warning, 1 info
  - added the new `user-already-exists` enum value to the `error` response property for the response status `default`
  - removed the `email-already-in-use` enum value from the `error` response property for the response status `default`
- **2026-01-13** `7560a2934be4` — 1 breaking
  - the `session/user/locale` response property's maxLength was increased from `2` to `3` for the response status `200`
- **2025-11-11** `484d9f1a422a` — 1 warning
  - added the new `provider-account-already-linked` enum value to the `error` response property for the response status `default`
- **2025-10-09** `2bb5c4e40463` — 1 warning, 3 info
  - added the new `email-already-in-use` enum value to the `error` response property for the response status `default`
  - removed the `otp-too-many-attempts` enum value from the `error` response property for the response status `default`
  - removed the `provider-account-already-linked` enum value from the `error` response property for the response status `default`
  - removed the `user-already-exists` enum value from the `error` response property for the response status `default`

[Change history](https://skmtc.dev/nhost/apis/nhost-authentication-api/changes/signin/email-password/post.md)

---

[API](https://skmtc.dev/nhost/apis/nhost-authentication-api.md) · [All operations](https://skmtc.dev/nhost/apis/nhost-authentication-api/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/nhost/nhost-authentication-api/revisions/a5c0d88b55c4/schema)