Authorization: Bearer on subsequent user-scoped requests. If the account has 2FA enabled, the response is a challenge you must complete with POST /api/auth/2fa/verify.
Method: POST Path: /api/auth/login Auth: None
Request
string
required
Email address or E.164 phone number.
string
required
Account password.
Response
string
Session JWT. Send as
Authorization: Bearer on subsequent requests.object
Signed-in user profile.
boolean
Present and
true when 2FA is enabled. In that case token is a short-lived challenge token; call POST /api/auth/2fa/verify to complete sign-in.