---
title: "Submit a Login Flow"
method: POST
path: "/self-service/login"
tags: ["v0alpha1"]
---

# Submit a Login Flow

`POST /self-service/login`

:::info

This endpoint is EXPERIMENTAL and subject to potential breaking changes in the future.

:::

Use this endpoint to complete a login flow. This endpoint
behaves differently for API and browser flows.

API flows expect `application/json` to be sent in the body and responds with
HTTP 200 and a application/json body with the session token on success;
HTTP 302 redirect to a fresh login flow if the original flow expired with the appropriate error messages set;
HTTP 400 on form validation errors.

Browser flows expect a Content-Type of `application/x-www-form-urlencoded` or `application/json` to be sent in the body and respond with
a HTTP 302 redirect to the post/after login URL or the `return_to` value if it was set and if the login succeeded;
a HTTP 302 redirect to the login UI URL with the flow ID containing the validation errors otherwise.

Browser flows with an accept header of `application/json` will not redirect but instead respond with
HTTP 200 and a application/json body with the signed in identity and a `Set-Cookie` header on success;
HTTP 302 redirect to a fresh login flow if the original flow expired with the appropriate error messages set;
HTTP 400 on form validation errors.

More information can be found at [Ory Kratos User Login and User Registration Documentation](https://www.ory.sh/docs/next/kratos/self-service/flows/user-login-user-registration).

## Query parameters

- `flow` string, required

## Request body

- SubmitSelfServiceLoginFlowBody
  - `csrf_token` string — Sending the anti-csrf token is only required for browser login flows.
  - `method` 'password' | 'oidc', required — Method should be set to "password" when logging in using the identifier and password strategy.
  - `password` string, required — The user's password.
  - `password_identifier` string, required — Identifier is the email or username of the user trying to log in.

## Response `200`

successfulSelfServiceLoginWithoutBrowser

- SuccessfulSelfServiceLoginWithoutBrowser — The Response for Login Flows via API
  - `session` Session, required — A Session
    - `active` boolean — Whether or not the session is active.
    - `authenticated_at` string, date-time — The Session Authentication Timestamp When this session was authenticated at.
    - `expires_at` string, date-time — The Session Expiry When this session expires at.
    - `id` string, uuid4, required
    - `identity` Identity, required — An identity can be a real human, a service, an IoT device - everything that can be described as an "actor" in a system.
      - `created_at` string, date-time — CreatedAt is a helper struct field for gobuffalo.pop.
      - `credentials` object — Credentials represents all credentials that can be used for authenticating this identity.
      - `id` string, uuid4, required
      - `recovery_addresses` RecoveryAddress[] — RecoveryAddresses contains all the addresses that can be used to recover an identity.
        - `created_at` string, date-time — CreatedAt is a helper struct field for gobuffalo.pop.
        - `id` string, uuid4, required
        - `updated_at` string, date-time — UpdatedAt is a helper struct field for gobuffalo.pop.
        - `value` string, required
        - `via` string, required
      - `schema_id` string, required — SchemaID is the ID of the JSON Schema to be used for validating the identity's traits.
      - `schema_url` string, required — SchemaURL is the URL of the endpoint where the identity's traits schema can be fetched from. format: url
      - `state` 'active' | 'inactive' — The state can either be `active` or `inactive`.
      - `state_changed_at` string, date-time
      - `traits` unknown, required
      - `updated_at` string, date-time — UpdatedAt is a helper struct field for gobuffalo.pop.
      - `verifiable_addresses` VerifiableIdentityAddress[] — VerifiableAddresses contains all the addresses that can be verified by the user.
        - `created_at` string, date-time — When this entry was created
        - `id` string, uuid4, required
        - `status` string, required — VerifiableAddressStatus must not exceed 16 characters as that is the limitation in the SQL Schema
        - `updated_at` string, date-time — When this entry was last updated
        - `value` string, required — The address value example foo@user.com
        - `verified` boolean, required — Indicates if the address has already been verified
        - `verified_at` string, date-time
        - `via` string, required — VerifiableAddressType must not exceed 16 characters as that is the limitation in the SQL Schema
    - `issued_at` string, date-time — The Session Issuance Timestamp When this session was authenticated at.
  - `session_token` string — The Session Token A session token is equivalent to a session cookie, but it can be sent in the HTTP Authorization Header: Authorization: bearer ${session-token} The session token is only issued for API flows, not for Browser flows!

## Other responses

- `302` — Empty responses are sent when, for example, resources are deleted. The HTTP status code for empty responses is typically 201.
- `400` — selfServiceLoginFlow
- `500` — jsonError

## Changes

- **2021-07-22** `071bec03ddcd` — 2 breaking, 2 warning
  - the response property `session/identity/state` became optional for the status `200`
  - the `session/identity/state` response's property type changed from no type to `string` for status `200`
  - added the new `active` enum value to the `session/identity/state` response property for the response status `200`
  - added the new `inactive` enum value to the `session/identity/state` response property for the response status `200`
- **2021-07-13** `8f1b399ab6e6` — 7 breaking, 10 info
  - removed `#/components/schemas/submitSelfServiceLoginFlowWithPasswordMethod` from the request body `oneOf` list (media type: application/json)
  - removed `#/components/schemas/submitSelfServiceLoginFlowWithPasswordMethod` from the request body `oneOf` list (media type: application/x-www-form-urlencoded)
  - the response property `ui/nodes/items/attributes/oneOf[#/components/schemas/uiNodeInputAttributes]/value` became nullable for the status `400`
  - the response property `session/authenticated_at` became optional for the status `200`
  - …13 more
- …earlier changes not shown

[Full history](https://skmtc.dev/ory/apis/ory-identities-api/changes/self-service/login/post.md)

---

[API](https://skmtc.dev/ory/apis/ory-identities-api.md) · [All operations](https://skmtc.dev/ory/apis/ory-identities-api/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/ory/ory-identities-api/revisions/071bec03ddcd/schema)