---
title: "POST /api/v1/auth/sessions"
method: POST
path: "/api/v1/auth/sessions"
tags: ["AuthService"]
---

# POST /api/v1/auth/sessions

`POST /api/v1/auth/sessions`

CreateSession authenticates a user and creates a new session.
 Returns the authenticated user information upon successful authentication.

## Request body

- CreateSessionRequest
  - `passwordCredentials` CreateSessionRequestPasswordCredentials — Nested message for password-based authentication credentials.
    - `username` string, required — The username to sign in with. Required field for password-based authentication.
    - `password` string, required — The password to sign in with. Required field for password-based authentication.
  - `ssoCredentials` CreateSessionRequestSSOCredentials — Nested message for SSO authentication credentials.
    - `idpId` integer, required — The ID of the SSO provider. Required field to identify the SSO provider.
    - `code` string, required — The authorization code from the SSO provider. Required field for completing the SSO flow.
    - `redirectUri` string, required — The redirect URI used in the SSO flow. Required field for security validation.
    - `codeVerifier` string — The PKCE code verifier for enhanced security (RFC 7636). Optional field - if provided, enables PKCE flow protection against authorization code interception.

## Response `200`

OK

- CreateSessionResponse
  - `user` User
    - `name` string — The resource name of the user. Format: users/{user}
    - `role` 'ROLE_UNSPECIFIED' | 'HOST' | 'ADMIN' | 'USER', enum, required — The role of the user.
    - `username` string, required — Required. The unique username for login.
    - `email` string — Optional. The email address of the user.
    - `displayName` string — Optional. The display name of the user.
    - `avatarUrl` string — Optional. The avatar URL of the user.
    - `description` string — Optional. The description of the user.
    - `password` string — Input only. The password for the user.
    - `state` 'STATE_UNSPECIFIED' | 'NORMAL' | 'ARCHIVED', enum, required — The state of the user.
    - `createTime` string, date-time — Output only. The creation timestamp.
    - `updateTime` string, date-time — Output only. The last update timestamp.
  - `lastAccessedAt` string, date-time — Last time the session was accessed. Used for sliding expiration calculation (last_accessed_time + 2 weeks).

## Other responses

- `default` — Default error response

## Changes

- **2025-12-15** `d740073f088f` — 1 info
  - endpoint added

[Change history](https://skmtc.dev/usememos/apis/untitled-api/changes/api/v1/auth/sessions/post.md)

---

[API](https://skmtc.dev/usememos/apis/untitled-api.md) · [All operations](https://skmtc.dev/usememos/apis/untitled-api/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/usememos/untitled-api/revisions/d740073f088f/schema)