---
title: "Create an authentication session."
method: POST
path: "/xrpc/com.atproto.server.createSession"
tags: ["com.atproto.server"]
---

# Create an authentication session.

`POST /xrpc/com.atproto.server.createSession`

## Request body

- object
  - `password` string, required
  - `identifier` string, required — Handle or other identifier supported by the server for the authenticating user.
  - `allowTakendown` boolean — When true, instead of throwing error for takendown accounts, a valid response with a narrow scoped token will be returned
  - `authFactorToken` string

## Response `200`

Success

- object
  - `did` string, did, required
  - `email` string
  - `active` boolean
  - `didDoc` unknown
  - `handle` string, handle, required
  - `status` string — If active=false, this optional field indicates a possible reason for why the account is not active. If active=false and no status is supplied, then the host makes no claim for why the repository is no longer being hosted.
  - `accessJwt` string, required
  - `refreshJwt` string, required
  - `emailConfirmed` boolean
  - `emailAuthFactor` boolean

## Other responses

- `400` — Bad Request

## Changes

- **2026-07-12** `0b39d9ed30de` — 1 info
  - endpoint added
- **2026-01-21** `b21cd7605630` — 1 breaking
  - api path removed without deprecation

[Change history](https://skmtc.dev/streamplace/apis/generated-lexicon-api-schema/changes/xrpc/com.atproto.server.createSession/post.md)

---

[API](https://skmtc.dev/streamplace/apis/generated-lexicon-api-schema.md) · [All operations](https://skmtc.dev/streamplace/apis/generated-lexicon-api-schema/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/streamplace/generated-lexicon-api-schema/revisions/62bdcd7bca9c/schema)