---
title: "Create a session"
method: POST
path: "/api/auth/login"
tags: ["Authentication"]
---

# Create a session

`POST /api/auth/login`

## Request

- Base URL: `https://slimlytics.com`
- URL: `https://slimlytics.com/api/auth/login`
- Auth: none required

## Request body

- Credentials
  - `email` string, email, required
  - `password` string, password, required

## Response `200`

Authenticated; returns a short-lived access JWT and a rotating refresh token

- TokenResponse
  - `token` string, required: Short-lived session JWT (Bearer access token)
  - `refreshToken` string, required: Opaque `slrt_` refresh token. Single use: every refresh returns a new one. Sessions stay signed in for 30 idle days (365 days at most).
  - `expiresIn` integer, required: Access token lifetime in seconds

## Other responses

- `400`: Invalid request
- `401`: Authentication required or invalid/expired credential
- `415`: Request Content-Type is not application/json
- `422`: JSON body could not be deserialized
- `500`: Internal service error

---

[API](https://skmtc.dev/slimlytics/apis/slimlytics-api.md) · [All operations](https://skmtc.dev/slimlytics/apis/slimlytics-api/llms.txt) · [OpenAPI document](https://skmtc.dev/slimlytics/apis/slimlytics-api/revisions/f9a26641a254?raw)