---
title: "POST /auth"
method: POST
path: "/auth"
tags: ["v2"]
---

# POST /auth

`POST /auth`

## Request body

- Auth
  - `access-id` string — Access ID
  - `access-key` string — Access key (relevant only for access-type=access_key)
  - `access-type` string — Access Type (access_key/password/saml/ldap/k8s/azure_ad/oidc/aws_iam/universal_identity/jwt/gcp/cert/oci/kerberos)
  - `account-id` string — Account id (relevant only for access-type=password where the email address is associated with more than one account)
  - `admin-email` string — Email (relevant only for access-type=password)
  - `admin-password` string — Password (relevant only for access-type=password)
  - `azure-cloud` string — Azure cloud environment to use. Values: AzureCloud (default), AzureUSGovernment, AzureChinaCloud.
  - `cert-challenge` string — Certificate challenge encoded in base64. (relevant only for access-type=cert)
  - `cert-data` string — Certificate data encoded in base64. Used if file was not provided. (relevant only for access-type=cert)
  - `cloud-id` string — The cloud identity (relevant only for access-type=azure_ad,aws_iam,gcp)
  - `debug` boolean
  - `disable-pafxfast` string — Disable the FAST negotiation in the Kerberos authentication method
  - `gateway-spn` string — The service principal name of the gateway as registered in LDAP (i.e., HTTP/gateway)
  - `gateway-url` string — Gateway URL relevant only for access-type=k8s/oauth2/saml/oidc
  - `gcp-audience` string — GCP JWT audience
  - `json` boolean — Set output format to JSON
  - `jwt` string — The Json Web Token (relevant only for access-type=jwt/oidc)
  - `k8s-auth-config-name` string — The K8S Auth config name (relevant only for access-type=k8s)
  - `k8s-service-account-token` string — The K8S service account token. (relevant only for access-type=k8s)
  - `kerberos-token` string — KerberosToken represents a Kerberos token generated for the gateway SPN (Service Principal Name).
  - `kerberos-username` string — TThe username for the entry within the keytab to authenticate via Kerberos
  - `key-data` string — Private key data encoded in base64. Used if file was not provided.(relevant only for access-type=cert)
  - `keytab-data` string — Base64-encoded content of a valid keytab file, containing the service account's entry.
  - `krb5-conf-data` string — Base64-encoded content of a valid krb5.conf file, specifying the settings and parameters required for Kerberos authentication.
  - `ldap-password` string — LDAP password (relevant only for access-type=ldap)
  - `oci-auth-type` string — The type of the OCI configuration to use [instance/apikey/resource] (relevant only for access-type=oci)
  - `oci-group-ocid` string[] — A list of Oracle Cloud IDs groups (relevant only for access-type=oci)
  - `otp` string
  - `signed-cert-challenge` string — Signed certificate challenge encoded in base64. (relevant only for access-type=cert)
  - `uid-token` string — The universal_identity token (relevant only for access-type=universal_identity)
  - `use-remote-browser` boolean — Returns a link to complete the authentication remotely (relevant only for access-type=saml/oidc)
  - `username` string — LDAP username (relevant only for access-type=ldap)

## Response `200`

authResponse wraps response body.

- AuthOutput
  - `complete_auth_link` string
  - `creds` SystemAccessCredentialsReplyObj
    - `access_id` string
    - `auth_creds` string — Temporary credentials for accessing Auth
    - `csrf_token` string — CSRF token for synchronizer-token pattern (only populated for WebUI clients)
    - `expiry` integer — Credentials expiration date
    - `kfm_creds` string — Temporary credentials for accessing the KFMs instances
    - `need_mfa_app_first_config` boolean — If the user didn't complete to configure the MFA app
    - `required_mfa` string
    - `token` string — Credentials tmp token
    - `uam_creds` string — Temporary credentials for accessing the UAM service
  - `expiration` string
  - `token` string

## Other responses

- `401` — errorResponse wraps any error to return it as a JSON object with one "error" field.
- `default` — errorResponse wraps any error to return it as a JSON object with one "error" field.

---

[API](https://skmtc.net/akeyless/apis/akeyless-api.md) · [All operations](https://skmtc.net/akeyless/apis/akeyless-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/akeyless/akeyless-api/versions/0ceb25634501/schema)