---
title: "Authenticate user"
method: POST
path: "/users/login"
tags: ["Users"]
---

# Authenticate user

`POST /users/login`

Validates email/password credentials via bcrypt. Returns a JWT access token
in the response body and sets a refresh token in an HTTP-only cookie.
Rate-limited to 5 requests per minute per IP.

## Request body

- object
  - `email` string, email, required
  - `password` string, password, required

## Response `202`

Authentication successful

- object
  - `message` string
  - `data` object
    - `token` string — JWT access token
    - `isSuperAdmin` boolean — Only present when user is super-admin (role_id=5)
    - `onboarding_status` string — Organization onboarding status (not present for super-admin)
    - `is_org_creator` boolean — Whether user is the first admin of the org (not present for super-admin)

## Other responses

- `401` — Invalid email or password
- `429` — Too many login attempts
- `500` — Internal server error

## Changes

- **2026-07-13** `d86d0bf8bebe` — 3 info
  - api operation id `loginUser` was added
  - api tag `Users` added
  - api tag `Authentication` removed
- **2026-07-13** `655215fe8c81` — 3 info
  - api operation id `loginUser` removed and replaced with ``
  - api tag `Authentication` added
  - api tag `Users` removed
- **2026-06-22** `5878ba786a89` — 3 info
  - api operation id `loginUser` was added
  - api tag `Users` added
  - api tag `Authentication` removed
- **2026-04-21** `c2977ab99485` — 2 info
  - api tag `Authentication` added
  - api tag `Users - Authentication` removed
- **2026-04-21** `55cdc040840c` — 4 breaking, 6 info
  - added the new required request property `email`
  - added the new required request property `password`
  - request body became required
  - removed the success response with the status `201`
  - …6 more

[Full history](https://skmtc.dev/verifywise-ai/apis/verifywise-api/changes/users/login/post.md)

---

[API](https://skmtc.dev/verifywise-ai/apis/verifywise-api.md) · [All operations](https://skmtc.dev/verifywise-ai/apis/verifywise-api/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/verifywise-ai/verifywise-api/revisions/d86d0bf8bebe/schema)