---
title: "Authenticate user"
method: POST
path: "/api/auth/login"
tags: ["Authentication"]
---

# Authenticate user

`POST /api/auth/login`

## Request

- Base URL: `https://api.sponsorunited.com` (the document declares no server; this is the origin it was published from)
- URL: `https://api.sponsorunited.com/api/auth/login`
- Auth: none declared
- TypeScript: <https://skmtc.dev/sponsorunited/apis/sponsorunited-api/docs/api/auth/login/post.ts> (a function with typed inputs; its response is checked against the schema)

Authenticates user credentials and generates an authentication token for further API calls. Returns MFA challenge if multi-factor authentication is enabled for the user.

## Request body `application/x-www-form-urlencoded`

- LoginRequest
  - `email` string, email, required
  - `password` string, password, required
  - `remember_me` boolean

## Response `200`

Authentication Token or mfa_enabled true

- LoginResource
  - `token` string, required: JWT authentication token
  - `session` string, required: Session signature
  - `mfa_enabled` boolean: Whether MFA verification is required
  - `user_id` integer: User ID (returned when MFA is enabled)
  - `has_phone` boolean: Whether user has phone number for SMS MFA
  - `force_new_password` integer: Whether user must reset password
  - `reset_token` string: Password reset token (when force_new_password is set)

---

[API](https://skmtc.dev/sponsorunited/apis/sponsorunited-api.md) - [All operations](https://skmtc.dev/sponsorunited/apis/sponsorunited-api/llms.txt) - [OpenAPI document](https://skmtc.dev/sponsorunited/apis/sponsorunited-api/revisions/cbf1ca5bff8f?raw)