---
title: "POST /api/user/token-auth/"
method: POST
path: "/api/user/token-auth/"
tags: ["User"]
---

# POST /api/user/token-auth/

`POST /api/user/token-auth/`

Authenticates an existing user based on their email and their password. If successful, an access token and a refresh token will be returned. If the account is protected with two-factor authentication, temporary token is returned to finish the verification.

## Request body

- TokenObtainPairWithUser
  - `email` string, email
  - `username` string, email — Deprecated. Use `email` instead.
  - `password` string, required

## Response `200`

- union
  - object
    - `user` object — An object containing information related to the user.
      - `first_name` string — The first name of related user.
      - `username` string, email — The username of the related user. This is always an email address.
      - `language` string — An ISO 639 language code (with optional variant) selected by the user. Ex: en-GB.
    - `token` string — Deprecated. Use the `access_token` instead.
    - `access_token` string — 'access_token' can be used to authorize for other endpoints that require authorization. This token will be valid for 10 minutes.
    - `refresh_token` string — 'refresh_token' can be used to get a new valid 'access_token'. This token will be valid for 168 hours.
  - object
    - `two_factor_auth` string — The type of the two factor auth that is required to perform.
    - `token` string — The temporary token for verifying authentication using 2fa.

## Other responses

- `401`

---

[API](https://skmtc.net/baserow/apis/baserow-api-spec.md) · [All operations](https://skmtc.net/baserow/apis/baserow-api-spec/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/baserow/baserow-api-spec/revisions/0c490e5b0c7f/schema)