Sign in
v0alpha1

Submit a Login Flow

:::info

This endpoint is EXPERIMENTAL and subject to potential breaking changes in the future.

:::

Use this endpoint to complete a login flow. This endpoint behaves differently for API and browser flows.

API flows expect application/json to be sent in the body and responds with HTTP 200 and a application/json body with the session token on success; HTTP 302 redirect to a fresh login flow if the original flow expired with the appropriate error messages set; HTTP 400 on form validation errors.

Browser flows expect a Content-Type of application/x-www-form-urlencoded or application/json to be sent in the body and respond with a HTTP 302 redirect to the post/after login URL or the return_to value if it was set and if the login succeeded; a HTTP 302 redirect to the login UI URL with the flow ID containing the validation errors otherwise.

Browser flows with an accept header of application/json will not redirect but instead respond with HTTP 200 and a application/json body with the signed in identity and a Set-Cookie header on success; HTTP 302 redirect to a fresh login flow if the original flow expired with the appropriate error messages set; HTTP 400 on form validation errors.

More information can be found at Ory Kratos User Login and User Registration Documentation.

post/self-service/login

Query parameters

flowstring required

The Login Flow ID

The value for this parameter comes from flow URL Query parameter sent to your application (e.g. /login?flow=abcde).

Request body

csrf_tokenstring

Sending the anti-csrf token is only required for browser login flows.

method'password' | 'oidc' required

Method should be set to "password" when logging in using the identifier and password strategy.

passwordstring required

The user's password.

password_identifierstring required

Identifier is the email or username of the user trying to log in.

Response

successfulSelfServiceLoginWithoutBrowser

session_tokenstring

The Session Token

A session token is equivalent to a session cookie, but it can be sent in the HTTP Authorization Header:

Authorization: bearer ${session-token}

The session token is only issued for API flows, not for Browser flows!

Example response

{
  "session_token": "session_token",
  "session": {
    "expires_at": "2000-01-23T04:56:07.000+00:00",
    "identity": {
      "recovery_addresses": [
        {
          "updated_at": "2000-01-23T04:56:07.000+00:00",
          "created_at": "2000-01-23T04:56:07.000+00:00",
          "id": "id",
          "value": "value",
          "via": "via"
        },
        {
          "updated_at": "2000-01-23T04:56:07.000+00:00",
          "created_at": "2000-01-23T04:56:07.000+00:00",
          "id": "id",
          "value": "value",
          "via": "via"
        }
      ],
      "traits": "",
      "updated_at": "2000-01-23T04:56:07.000+00:00",
      "credentials": {
        "key": {
          "updated_at": "2000-01-23T04:56:07.000+00:00",
          "identifiers": [
            "identifiers",
            "identifiers"
          ],
          "created_at": "2000-01-23T04:56:07.000+00:00",
          "type": "type",
          "config": "{}"
        }
      },
      "verifiable_addresses": [
        {
          "updated_at": "2014-01-01T23:28:56.782Z",
          "verified_at": "2000-01-23T04:56:07.000+00:00",
          "verified": true,
          "created_at": "2014-01-01T23:28:56.782Z",
          "id": "id",
          "value": "value",
          "status": "status",
          "via": "via"
        },
        {
          "updated_at": "2014-01-01T23:28:56.782Z",
          "verified_at": "2000-01-23T04:56:07.000+00:00",
          "verified": true,
          "created_at": "2014-01-01T23:28:56.782Z",
          "id": "id",
          "value": "value",
          "status": "status",
          "via": "via"
        }
      ],
      "schema_id": "schema_id",
      "state_changed_at": "2000-01-23T04:56:07.000+00:00",
      "created_at": "2000-01-23T04:56:07.000+00:00",
      "schema_url": "schema_url",
      "id": "id"
    },
    "authenticated_at": "2000-01-23T04:56:07.000+00:00",
    "active": true,
    "id": "id",
    "issued_at": "2000-01-23T04:56:07.000+00:00"
  }
}

Changes