---
title: "POST /api/v1/auth/signin"
method: POST
path: "/api/v1/auth/signin"
tags: ["AuthService"]
---

# POST /api/v1/auth/signin

`POST /api/v1/auth/signin`

SignIn authenticates a user with credentials and returns tokens.
 On success, returns an access token and sets a refresh token cookie.
 Supports password-based and SSO authentication methods.

## Request body

- SignInRequest
  - `passwordCredentials` SignInRequestPasswordCredentials — Nested message for password-based authentication credentials.
    - `username` string, required — The username to sign in with.
    - `password` string, required — The password to sign in with.
  - `ssoCredentials` SignInRequestSSOCredentials — Nested message for SSO authentication credentials.
    - `idpName` string, required — The resource name of the SSO provider. Format: identity-providers/{idp}
    - `code` string, required — The authorization code from the SSO provider.
    - `redirectUri` string, required — The redirect URI used in the SSO flow.
    - `codeVerifier` string — The PKCE code verifier for enhanced security (RFC 7636). Optional - enables PKCE flow protection against authorization code interception.

## Response `200`

OK

- SignInResponse
  - `user` User
    - `name` string — The resource name of the user. Format: users/{user}
    - `role` 'ROLE_UNSPECIFIED' | 'ADMIN' | 'USER', enum, required — The role of the user.
    - `username` string, required — Required. The unique username for login.
    - `email` string — Optional. The email address of the user.
    - `displayName` string — Optional. The display name of the user.
    - `avatarUrl` string — Optional. The avatar URL of the user.
    - `description` string — Optional. The description of the user.
    - `password` string — Input only. The password for the user.
    - `state` 'STATE_UNSPECIFIED' | 'NORMAL' | 'ARCHIVED', enum, required — The state of the user.
    - `createTime` string, date-time — Output only. The creation timestamp.
    - `updateTime` string, date-time — Output only. The last update timestamp.
  - `accessToken` string — The short-lived access token for API requests. Store in memory only, not in localStorage.
  - `accessTokenExpiresAt` string, date-time — When the access token expires. Client should call RefreshToken before this time.

## Other responses

- `default` — Default error response

## Changes

> 63 revisions in range; 51 could not be searched.

- **2025-12-15** `d740073f088f` — 1 breaking
  - api path removed without deprecation

[Change history](https://skmtc.dev/usememos/apis/untitled-api/changes/api/v1/auth/signin/post.md)

---

[API](https://skmtc.dev/usememos/apis/untitled-api.md) · [All operations](https://skmtc.dev/usememos/apis/untitled-api/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/usememos/untitled-api/revisions/9f2688df7c2e/schema)