---
title: "Sign in (first-party)"
method: POST
path: "/users/sign-in"
tags: ["Public", "Sessions"]
---

# Sign in (first-party)

`POST /users/sign-in`

## Request

- Base URL: `https://api.purplegrain.com/api/v1`
- URL: `https://api.purplegrain.com/api/v1/users/sign-in`
- Auth: none declared

**First-party** email/password login. Returns a **Doorkeeper** access token in JSON — same fields as
**`POST /oauth/token`** with `grant_type=password`, plus **`user_id`**. Does not require `client_id` / `client_secret`
in the request (the server uses the configured first-party OAuth application). For third-party or strict OAuth
clients, call **`POST /oauth/token`** on the host root instead (see **OAuth** tag).

## Request body

- object
  - `user` object
    - `email` string, email
    - `password` string

## Response `200`

Success — Doorkeeper access token; includes `user_id` for convenience.

- DoorkeeperAccessTokenResponse: Access token issued by Doorkeeper. The same fields are returned from `POST /oauth/token` (RFC 6749). First-party endpoints (`POST /users/sign-in`, `POST /users/access-tokens`) add `user_id` for convenience.
  - `access_token` string, required: Opaque bearer token. Send as header Authorization: Bearer {token} on /api/v1/* routes.
  - `token_type` string, required
  - `expires_in` integer: Lifetime of the access token in seconds.
  - `refresh_token` string, nullable: Present when the client and grant type allow refresh tokens.
  - `scope` string: Granted scopes (space-separated).
  - `user_id` string, uuid, nullable: Only returned by first-party JSON endpoints (`/users/sign-in`, `/users/access-tokens`), not by `POST /oauth/token`.
  - `actor_id` string, uuid, nullable: The acting entity's id (first-party endpoints only). Equals `user_id` today; becomes the Organization id when a token is scoped to act for an organization.
  - `actor_type` 'User' | 'Organization', nullable: Polymorphic type of `actor_id` (first-party endpoints only).

## Other responses

- `403`: Forbidden — first-party only; refused to an API key or an assistant's token.
- `422`: Invalid request

---

[API](https://skmtc.dev/purplegrain/apis/purple-grain-api.md) · [All operations](https://skmtc.dev/purplegrain/apis/purple-grain-api/llms.txt) · [OpenAPI document](https://skmtc.dev/purplegrain/apis/purple-grain-api/revisions/06540345bbbc?raw)