---
title: "Login"
method: POST
path: "/api/v1/login"
tags: ["Login", "Public API"]
deprecated: true
---

# Login

`POST /api/v1/login`

> **Deprecated.**

Exchanges username, password, and application key for a persistent API key scoped to that user and application. No pre-existing authentication is required; credentials are passed in the request body. On success, returns a persistent API key, the authenticated user ID, the linked employee ID (null when no employee record is associated), and the base API URL to use for subsequent requests.

This endpoint is deprecated. New integrations should prefer OAuth or OpenID Connect instead.

`applicationKey` must correspond to a registered non-mobile application; iOS and Android app keys are explicitly rejected with a 403 (no body). The optional `deviceId` associates the generated key with a specific device.

Response format is determined by the `Accept` request header. Send `Accept: application/json` to receive JSON; omit the header or send any other value to receive XML. Alternatively, set `?format=json` in the query string to force JSON regardless of the `Accept` header.

Note: If the company has SSO enabled and password login is disabled, this endpoint returns HTTP 200 with a plain-text error message rather than a structured error response.

## Query parameters

- `format` 'json'

## Headers

- `AcceptHeaderParameter` 'application/xml' | 'application/json'

## Response `200`

Successful authentication.

- object
  - `success` boolean, required — Always `true` on HTTP 200.
  - `userId` integer, required — The authenticated user ID.
  - `employeeId` integer, nullable — The employee ID linked to this user. `null` when no employee record is associated.
  - `key` string, required — The API key to use for subsequent requests.
  - `apiUrl` string, uri, required — The base URL for subsequent API calls.

## Other responses

- `403` — Forbidden. Credential or key failure. Credential and key failures include a response body; mobile application key rejections return an empty body.
- `500` — Internal Server Error. API key creation failed.

---

[API](https://skmtc.net/bamboohr/apis/bamboohr-api.md) · [All operations](https://skmtc.net/bamboohr/apis/bamboohr-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/bamboohr/bamboohr-api/revisions/19ebf391a399/schema)