---
title: "Initialize Login Flow for APIs, Services, Apps, ..."
method: GET
path: "/self-service/login/api"
tags: ["v0alpha1"]
---

# Initialize Login Flow for APIs, Services, Apps, ...

`GET /self-service/login/api`

This endpoint initiates a login flow for API clients that do not use a browser, such as mobile devices, smart TVs, and so on.

If a valid provided session cookie or session token is provided, a 400 Bad Request error
will be returned unless the URL query parameter `?refresh=true` is set.

To fetch an existing login flow call `/self-service/login/flows?flow=<flow_id>`.

You MUST NOT use this endpoint in client-side (Single Page Apps, ReactJS, AngularJS) nor server-side (Java Server
Pages, NodeJS, PHP, Golang, ...) browser applications. Using this endpoint in these applications will make
you vulnerable to a variety of CSRF attacks, including CSRF login attacks.

This endpoint MUST ONLY be used in scenarios such as native mobile apps (React Native, Objective C, Swift, Java, ...).

More information can be found at [Ory Kratos User Login and User Registration Documentation](https://www.ory.sh/docs/next/kratos/self-service/flows/user-login-user-registration).

## Query parameters

- `refresh` boolean

## Response `200`

selfServiceLoginFlow

- SelfServiceLoginFlow — This object represents a login flow. A login flow is initiated at the "Initiate Login API / Browser Flow" endpoint by a client. Once a login flow is completed successfully, a session cookie or session token will be issued.
  - `active` string — and so on.
  - `created_at` string, date-time — CreatedAt is a helper struct field for gobuffalo.pop.
  - `expires_at` string, date-time, required — ExpiresAt is the time (UTC) when the flow expires. If the user still wishes to log in, a new flow has to be initiated.
  - `forced` boolean — Forced stores whether this login flow should enforce re-authentication.
  - `id` string, uuid4, required
  - `issued_at` string, date-time, required — IssuedAt is the time (UTC) when the flow started.
  - `request_url` string, required — RequestURL is the initial URL that was requested from Ory Kratos. It can be used to forward information contained in the URL's path or query for example.
  - `type` string, required — The flow type can either be `api` or `browser`.
  - `ui` UiContainer, required — Container represents a HTML Form. The container can work with both HTTP Form and JSON requests
    - `action` string, required — Action should be used as the form action URL `<form action="{{ .Action }}" method="post">`.
    - `messages` UiText[]
      - `context` object — The message's context. Useful when customizing messages.
      - `id` integer, required
      - `text` string, required — The message text. Written in american english.
      - `type` string, required
    - `method` string, required — Method is the form method (e.g. POST)
    - `nodes` UiNode[], required
      - `attributes` union, required
        - UiNodeInputAttributes — InputAttributes represents the attributes of an input node
          - `disabled` boolean, required — Sets the input's disabled field to true or false.
          - `label` UiText
            - `context` object — The message's context. Useful when customizing messages.
            - `id` integer, required
            - `text` string, required — The message text. Written in american english.
            - `type` string, required
          - `name` string, required — The input's element name.
          - `pattern` string — The input's pattern.
          - `required` boolean — Mark this input field as required.
          - `type` string, required
          - `value` unknown
        - UiNodeTextAttributes
          - `text` UiText, required
            - `context` object — The message's context. Useful when customizing messages.
            - `id` integer, required
            - `text` string, required — The message text. Written in american english.
            - `type` string, required
        - UiNodeImageAttributes
          - `src` string, required — The image's source URL. format: uri
        - UiNodeAnchorAttributes
          - `href` string, required — The link's href (destination) URL. format: uri
          - `title` UiText, required
            - `context` object — The message's context. Useful when customizing messages.
            - `id` integer, required
            - `text` string, required — The message text. Written in american english.
            - `type` string, required
      - `group` string, required
      - `messages` UiText[], required
        - `context` object — The message's context. Useful when customizing messages.
        - `id` integer, required
        - `text` string, required — The message text. Written in american english.
        - `type` string, required
      - `meta` Meta, required — This might include a label and other information that can optionally be used to render UIs.
        - `label` UiText
          - `context` object — The message's context. Useful when customizing messages.
          - `id` integer, required
          - `text` string, required — The message text. Written in american english.
          - `type` string, required
      - `type` string, required
  - `updated_at` string, date-time — UpdatedAt is a helper struct field for gobuffalo.pop.

## Other responses

- `400` — jsonError
- `500` — jsonError

## Changes

- **2021-07-13** `8f1b399ab6e6` — 1 breaking, 4 info
  - the response property `ui/nodes/items/attributes/oneOf[#/components/schemas/uiNodeInputAttributes]/value` became nullable for the status `200`
  - api operation id `initializeSelfServiceLoginForNativeApps` removed and replaced with `initializeSelfServiceLoginFlowWithoutBrowser`
  - api tag `v0alpha1` added
  - api tag `public` removed
  - …1 more
- **2021-05-18** `9123bcead5ed` — 7 info
  - api operation id `initializeSelfServiceLoginViaAPIFlow` removed and replaced with `initializeSelfServiceLoginForNativeApps`
  - added the optional property `created_at` to the response with the `200` status
  - added the optional property `updated_at` to the response with the `200` status
  - the response property `error` became required for the status `400`
  - …3 more
- **2021-05-05** `381c760af46e` — 14 breaking, 25 warning, 67 info
  - the response property `error` became optional for the status `400`
  - the response property `error/message` became optional for the status `400`
  - added `subschema #1, subschema #2, subschema #3` to the `ui/nodes/items/attributes/oneOf[#/components/schemas/uiNodeInputAttributes]/value` response property `oneOf` list for the response status `200`
  - the `id` response's property type/format changed from `string`/`uuid` to `string`/`uuid4` for status `200`
  - …102 more

[Change history](https://skmtc.dev/ory/apis/ory-identities-api/changes/self-service/login/api/get.md)

---

[API](https://skmtc.dev/ory/apis/ory-identities-api.md) · [All operations](https://skmtc.dev/ory/apis/ory-identities-api/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/ory/ory-identities-api/revisions/071bec03ddcd/schema)