---
title: "Log in (get a session token)"
method: POST
path: "/auth/login"
tags: ["Authentication"]
---

# Log in (get a session token)

`POST /auth/login`

## Request

- Base URL: `https://saturnsql.com/api`
- URL: `https://saturnsql.com/api/auth/login`
- Auth: none required

Exchanges email + password for a 24h JWT session token and a refresh token. If MFA is enrolled, returns `{ mfaRequired: true, mfaToken }` instead — complete the login with POST /auth/mfa/login. For scripts and AI agents prefer a `sat_live_` API key over this flow.

## Request body

- object
  - `email` string, required
  - `password` string, required

## Response `200`

Authenticated (or MFA challenge)

- AuthSession: A successful authentication: session token plus the signed-in user and their companies.
  - `token` string, required: JWT session token (24h). Send as `Authorization: Bearer <token>`.
  - `refreshToken` string, required: Long-lived refresh token (30d) for POST /auth/refresh.
  - `selectedCompanyId` string
  - `mustChangePassword` boolean
  - `user` object
    - `id` string
    - `email` string
    - `name` string
  - `companies` object[]
    - `id` string
    - `name` string
    - `plan` string

## Other responses

- `400`: Validation failed
- `401`: Bad or missing credentials

---

[API](https://skmtc.dev/saturnsql/apis/saturnsql-api.md) · [All operations](https://skmtc.dev/saturnsql/apis/saturnsql-api/llms.txt) · [OpenAPI document](https://skmtc.dev/saturnsql/apis/saturnsql-api/revisions/90a3e54ad115?raw)