---
title: "Log in"
method: POST
path: "/auth/login"
tags: ["Auth"]
---

# Log in

`POST /auth/login`

## Request

- Base URL: `https://tasg.app/api/v1`
- URL: `https://tasg.app/api/v1/auth/login`
- Auth: none required

Returns the user, their workspaces and a JWT pair in the body (no cookies). For machine clients prefer a personal API token (`POST /tokens`): JWTs expire after 15 minutes.

## Request body

- object
  - `email` string, email, required
  - `password` string, required

## Response `200`

Session.

- Session
  - `user` AuthUser, required
    - `id` string, uuid, required
    - `email` string, email, required
    - `full_name` string, required
    - `avatar_url` string, uri, nullable
    - `job_role` string, nullable
    - `role` 'admin' | 'member' | 'guest', required: Instance-level role. `guest` users are restricted to projects they were invited to.
    - `status` 'active' | 'inactive', required
    - `timezone` string, required
    - `onboarding_completed_at` string, date-time, nullable
  - `workspaces` AuthWorkspace[], required
    - `id` string, uuid, required
    - `name` string, required
    - `owner_id` string, uuid, required
    - `memory_enabled` boolean, required
    - `project_count` integer, required
  - `token` string, required: Access JWT (15 min). Send as `Authorization: Bearer …`.
  - `refreshToken` string, required: Refresh JWT (30 days). Exchange at POST /auth/refresh.

## Other responses

- `400`: Validation failed: the body or query did not match the schema, or a business rule was violated. `error` says which.
- `401`: Invalid email or password.
- `403`: Email not yet verified (public instances only).
- `429`: Too many login attempts from this IP. Try again later.

---

[API](https://skmtc.dev/tasg/apis/tasg-api.md) · [All operations](https://skmtc.dev/tasg/apis/tasg-api/llms.txt) · [OpenAPI document](https://skmtc.dev/tasg/apis/tasg-api/revisions/cd2a1dbaf5cf?raw)