---
title: "User Login"
method: POST
path: "/v1/auth/login"
tags: ["Auth"]
---

# User Login

`POST /v1/auth/login`

## Request

- Base URL: `https://api.robosystems.ai` (the document declares no server; this is the origin it was published from)
- URL: `https://api.robosystems.ai/v1/auth/login`
- Auth: none declared

Returns a JWT token on success. IP-based progressive delays apply after repeated failures.

## Request body

- LoginRequest: Login request model.
  - `email` string, email, required: User's email address
  - `password` string, required: User's password

## Response `200`

Successful Response

- AuthResponse: Authentication response model.
  - `user` object, required: User information
  - `org` object, nullable: Organization information (personal org created automatically on registration)
  - `message` string, required: Success message
  - `status` 'authenticated' | 'mfa_required' | 'mfa_enrollment_required': Login flow state: authenticated (token present), or a passkey MFA step is required before a session is issued (mfa_token present)
  - `mfa_token` string, nullable: Short-lived token authorizing the MFA second step or forced enrollment; present only when status is not 'authenticated'
  - `token` string, nullable: JWT authentication token (optional for cookie-based auth)
  - `expires_in` integer, nullable: Token expiry time in seconds from now
  - `refresh_threshold` integer, nullable: Recommended refresh threshold in seconds before expiry

## Other responses

- `400`: Invalid request
- `401`: Invalid credentials
- `422`: Validation Error
- `429`: Rate limit exceeded
- `500`: Internal server error

---

[API](https://skmtc.dev/robosystems/apis/robosystems-api.md) · [All operations](https://skmtc.dev/robosystems/apis/robosystems-api/llms.txt) · [OpenAPI document](https://skmtc.dev/robosystems/apis/robosystems-api/revisions/e661e2d5ca6a?raw)