---
title: "Login"
method: POST
path: "/v1/auth"
tags: ["Auth"]
---

# Login

`POST /v1/auth`

## Request

- Base URL: `https://identity-api.paymongo.com`
- URL: `https://identity-api.paymongo.com/v1/auth`
- Auth: none required

When `code` is omitted: validate credentials, then either issue an OTP challenge (LoginMFA on, response type "challenge") or issue tokens (LoginMFA off, response type "jwt"). When `code` is populated: validate credentials, verify the OTP, and issue tokens (response type "jwt").

## Request body

- AuthLoginRequestEnvelopeDTO
  - `data` object
    - `attributes` AuthLoginRequestDTO
      - `code` string
      - `email` string, required
      - `factor` 'email' | 'totp' | 'recovery_code': Factor selects the second factor. "totp" and "email" are both available OTP options: omit (or send "totp") to use the caller's authenticator when one is enrolled, or send "email" to receive a one-time code by mail instead, which is permitted whether or not an authenticator is enrolled. "recovery_code" spends one of the caller's break-glass codes. Ignored when LoginMFA is off. Whatever leg 1 resolves to is echoed back on the challenge response, and leg 2 must send the SAME value: an omitted factor at leg 2 means "email", so dropping it after being offered "totp" verifies against an email OTP that was never issued.
      - `password` string, required

## Response `201`

Created

- object: Standard response containing data and its metadata if any
  - `data` AuthLoginResponseDTO
    - `attributes` AuthLoginAttributesDTO
      - `expiry_timer` integer
      - `login_mfa` boolean
      - `login_notification` boolean
      - `organization_id` string
      - `user_contact_number` string
      - `user_first_name` string
      - `user_last_name` string
    - `id` string
    - `type` string
  - `has_more` boolean

## Other responses

- `400`: Bad Request
- `401`: Unauthorized
- `410`: Gone
- `422`: Unprocessable Entity
- `429`: Too Many Requests
- `500`: Internal Server Error
- `502`: Bad Gateway

---

[API](https://skmtc.dev/paymongo/apis/identity.md) - [All operations](https://skmtc.dev/paymongo/apis/identity/llms.txt) - [OpenAPI document](https://skmtc.dev/paymongo/apis/identity/revisions/cc3056164874?raw)