Log in

Verifies credentials, rotates and sets the yp_session cookie, and returns the same bootstrap payload as GET /me. Wrong password, unknown email, and a temporarily locked account all return the same 401. Limited to 10 attempts per IP per minute, plus a progressive per-account lock.

post/auth/login

Request

  • Base URL: https://app.yoping.me/api/v1
  • URL: https://app.yoping.me/api/v1/auth/login
  • Auth: none required

Request body

emailstring email required
passwordstring required

Response

Either fully logged in (password alone was sufficient; the session cookie is set and the /me bootstrap payload is returned) or, for an account with TOTP enrolled, phase 1 only — no cookie is set yet, and the response instead carries a totp_token to submit to POST /auth/login/totp along with a 6-digit code or recovery code.

OR

Changes

No recorded changes to this operation across all 1 revision of this API.