API/Auth/Sign in (password)

Sign in (password)

POST/v1/auth/login

Authenticate with email + password. Returns an access_token (900 s by default, adjustable per project) and a refresh_token (30 days by default). If MFA is required, the response remains 200 but carries mfa_required instead of tokens.

This English text was generated automatically from the French original and has not been reviewed yet.

signin.tstypescript

const { data } = await aura.auth.signInWithPassword({
  email: email, password: password,
})

200.jsonjson

{
  "data": {
    "access_token": "eyJhbGc...",
    "refresh_token": "...",
    "token_type": "Bearer",
    "expires_in": 900,    // seconds; project default 900, limited to [60, 86400]
    "user": { "id": "...", "email": "...", "role": "...", … }
  },
  "meta": null
}

Request

Bodysuit

Parameter	Type	Required	Description
`email`	`string`	yes	Account email. Normalized (trim + lowercase) on the server side.
`password`	`string`	yes	Password. Argon2id verify.
`captcha_token`	`string`	no	CAPTCHA token, required only if CAPTCHA is enabled in the project settings.

Notes

Rate limit

Attention

Two limits accumulate: that of the auth router (5 req/min per IP, burst 3, shared with register / forgot-password / magic-link / refresh) and a quota per project — 30 connection attempts per hour and per IP by default, modifiable in the project settings. The CAPTCHA is never imposed automatically: it is only checked if it has been activated for the project.

v1.0 · revised Apr 15, 2026
↗ OpenAPI spec↗ GitHub

← PREVIOUS

NEXT →

Refresh