Authenticates a user with the email and password they set when registering. This is the first step of signing in.

What you get back

On success, a token of type AUTH. An auth token doesn't authorize ordinary API calls. It only reaches /identities and /access_token. Exchange it for an access token with Create an access token before doing anything else. If the user belongs to more than one identity, read the list first with List linked identities and let them choose.

The token is valid for 5 minutes from last activity.

Expired passwords

A 409 means the password has expired. The response still carries a token, but a temporary one that works only for Update a password. Send the user through a password change and then sign them in again.

A 423 means the account is locked; a 410 means the token supplied has expired.

Other ways in

Verify with biometrics is an alternative to a password, and feeds the same access token exchange.

{
  "email": "alex@example.com",
  "password": {
    "value": "Passw0rd!"
  }
}

{
  "identity": {
    "type": "CONSUMER",
    "id": "123456789"
  },
  "credentials": {
    "type": "USER",
    "id": "987654321"
  }
}