---
title: "Login to application"
method: POST
path: "/login"
---

# Login to application

`POST /login`

Supports both json and form request types. If the caller is already logged in, then in the form case, they are redirected to SECURITY_POST_LOGIN_VIEW, for a json request, a 400 is returned.

## Query parameters

- `next` string
- `include_auth_token` string

## Request body

- Login
  - `email` string, required — user email
  - `password` string, required — Password
  - `remember` boolean — If true, will remember userid as part of cookie. There is a configuration variable DEFAULT_REMEMBER_ME that can be set. This field will override that.

## Response `200`

Login response

- object — The user successfully signed in using their primary credential. Note that depending on SECURITY_TWO_FACTOR configuration variable, a second form of authentication might be required prior to the user being fully authenticated. `tf_required` will be set to True in this case. Note that if 2FA is not configured, only the ``tf_required`` property (=False) will be returned.
  - `meta` object, required
    - `code` integer, required — Http status code
  - `response` object, required
    - `user` object — By default an empty dictionary is returned. However by overriding _User::get_security_payload()_ any attributes of the User model can be returned.
      - `authentication_token` string — Token to be used in future token-based API calls. Note this only returned from those APIs that accept a 'include_auth_token' query param.
      - `refresh_token` string — A refresh token that can be used to get a new auth token. This is only returned if the application has enabled refresh tokens.
    - `csrf_token` string — Session CSRF token
    - `tf_required` boolean — True if two-factor authentication is required for caller.
    - `tf_state` string — if "setup_from_login" then the caller must go through two-factor setup endpoint. If "ready" then a code has been sent and should be supplied to SECURITY_TWO_FACTOR_TOKEN_VALIDATION_URL.
    - `tf_method` string — Which method was used to send code.
    - `tf_select` boolean — If user has setup multiple forms of two-factor authentication, this will be True and the application should prompt the user for which method they want to use.
    - `tf_setup_methods` string[]

## Other responses

- `302` — If the caller is already authenticated, the form contents is ignored and a redirect is done: redirect(SECURITY_POST_LOGIN_VIEW) (note that 'next' is ignored). If the caller is NOT already authenticated, and the form contents are validated the caller will be redirected to: redirect(next) or redirect(SECURITY_POST_LOGIN_VIEW)
- `400` — Errors while validating login, or caller already authenticated/logged in.

## Changes

> 52 revisions in range; 15 could not be searched.

- **2023-10-22** `b647a0e917e6` — 4 breaking, 4 info
  - the response's body type/format changed from ``/`` to `object`/`` for status `400`
  - the response's body type/format changed from `object`/`` to ``/`` for status `200`
  - removed the required property `meta` from the response with the `200` status
  - removed the required property `response` from the response with the `200` status
  - …4 more
- **2023-07-25** `205261c882e3` — 2 warning
  - removed the request property `tf_validity_token` (media type: application/json)
  - removed the request property `tf_validity_token` (media type: application/x-www-form-urlencoded)
- **2022-07-22** `4b3ea48a957a` — 1 breaking, 2 warning, 2 info
  - the `allOf[subschema #2]/response/errors` response's property type/format changed from `object`/`` to `array`/`` for status `400`
  - removed the optional property `allOf[subschema #2]/response/error` from the response with the `400` status
  - removed the optional property `allOf[subschema #2]/response/errors/field-name` from the response with the `400` status
  - added the optional property `allOf[subschema #2]/response/field_errors` to the response with the `400` status
  - …1 more
- …earlier changes not shown

[Full history](https://skmtc.dev/pallets-eco/apis/flask-security-external-api/changes/login/post.md)

---

[API](https://skmtc.dev/pallets-eco/apis/flask-security-external-api.md) · [All operations](https://skmtc.dev/pallets-eco/apis/flask-security-external-api/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/pallets-eco/flask-security-external-api/revisions/ee92f388dafa/schema)