---
title: "Admin Password Login"
method: POST
path: "/v1/admin/auth/login"
---

# Admin Password Login

`POST /v1/admin/auth/login`

## Request

- Base URL: `https://api.storyflo.com` (the document declares no server; this is the origin it was published from)
- URL: `https://api.storyflo.com/v1/admin/auth/login`
- Auth: none declared

Shared email+password admin sign-in → returns the admin token.

A friendlier alternative to pasting ``admin_token`` directly or using
the magic link: POST {"email": ..., "password": ...} and, on a correct
match, get back the same token the rest of /v1/admin/* expects in
``X-Storyflo-Email-Token``.

Auth: ``ADMIN_LOGIN_EMAIL`` + ``ADMIN_LOGIN_PASSWORD`` env vars, matched
against ``ADMIN_TOKEN`` as the returned secret. When any of the three is
unset the endpoint is disabled (503) — we never authenticate against a
blank credential.

The /v1/admin/* per-IP rate-limit middleware (_admin_path_rate_limit)
already throttles this path by prefix, on top of the per-route limit
above, so credential-stuffing is bounded.

Errors:
  - 503 password login not configured (any of email/password/token unset)
  - 401 invalid credentials (generic — bad email and bad password are
    indistinguishable, by status and body and by timing)

## Request body

- AdminPasswordLoginRequest
  - `email` string, required
  - `password` string, required

## Response `200`

Successful Response

- object

## Other responses

- `422`: Validation Error

---

[API](https://skmtc.dev/storyflo/apis/storyflo-inference-router.md) · [All operations](https://skmtc.dev/storyflo/apis/storyflo-inference-router/llms.txt) · [OpenAPI document](https://skmtc.dev/storyflo/apis/storyflo-inference-router/revisions/c3a1a735ac7a?raw)