---
title: "POST /api/auth/signin"
method: POST
path: "/api/auth/signin"
tags: ["AuthService"]
---

# POST /api/auth/signin

`POST /api/auth/signin`

## Request

- The document declares no server URL.
- Auth: none declared

SignIn authenticates a user with password or SSO credentials.
 On success, returns a short-lived access token and sets a refresh token in an HttpOnly cookie.
 Public. Attempts are rate limited. Archived users cannot sign in.

## Request body

- SignInRequest: Request message for AuthService.SignIn.
  - `passwordCredentials` SignInRequestPasswordCredentials: PasswordCredentials are a username and password. Regular users cannot use them when the instance disallows password sign-in.
    - `username` string, required: Required. The username to sign in with.
    - `password` string, required: Required. The password to sign in with.
  - `ssoCredentials` SignInRequestSsoCredentials: SsoCredentials are the result of an OAuth2 authorization code flow with an identity provider. A first sign-in creates a local user unless the instance disallows user registration.
    - `identityProvider` string, required: Required. The resource name of the identity provider. Format: identity-providers/{idp}
    - `code` string, required: Required. The authorization code returned by the identity provider.
    - `redirectUri` string, required: Required. The redirect URI used in the authorization request.
    - `codeVerifier` string: Optional. The PKCE code verifier (RFC 7636). Set it when the authorization request used a code challenge.

## Response `200`

OK

- SignInResponse: Response message for AuthService.SignIn.
  - `user` User: User is an account on the instance.
    - `name` string: Identifier. The resource name of the user. {user} is the username. Format: users/{user}
    - `username` string, required: Required. The unique username, used to sign in.
    - `displayName` string: Optional. The display name of the user.
    - `email` string: Optional. The email address of the user. Stored trimmed and lowercased; empty means no address. An address belongs to at most one user on the instance, so writes that would reuse one fail with ALREADY_EXISTS. Returned only to the user and to admins.
    - `avatarUrl` string: Optional. The avatar URL of the user. An avatar set as a data URI (PNG, JPEG, GIF or WebP, at most 2 MiB) is returned as a file server URL.
    - `description` string: Optional. The description of the user.
    - `password` string: Input only. The password of the user. Never returned.
    - `role` 'ROLE_UNSPECIFIED' | 'ADMIN' | 'USER', enum, required: Required. The role of the user. Only admins can change it.
    - `state` 'STATE_UNSPECIFIED' | 'NORMAL' | 'ARCHIVED', enum, required: Required. The state of the user. Only admins can change it.
    - `createTime` string, date-time: Output only. The creation timestamp.
    - `updateTime` string, date-time: Output only. The last update timestamp.
  - `accessToken` string: The short-lived access token for API requests. Keep it in memory only, not in localStorage.
  - `accessTokenExpireTime` string, date-time: When the access token expires. Call RefreshToken before this time.

## Other responses

- `default`: Default error response

## Changes

- **2026-10-08** `1846a777b0ef`: 1 info
  - endpoint added

[Operation history](https://skmtc.dev/usememos/apis/untitled-api/changes/api/auth/signin/post.md)

---

[API](https://skmtc.dev/usememos/apis/untitled-api.md) - [All operations](https://skmtc.dev/usememos/apis/untitled-api/llms.txt) - [OpenAPI document](https://skmtc.dev/usememos/apis/untitled-api/revisions/f587355e35b4?raw)