Sign in
latestOpenAPI 3.1.02026-08-194237902.5 MB

563848e0ecc0

Auth

Authenticate a human user with email and password

Exchanges a user's email address and password for a short-lived access token issued by Auth0's Resource Owner Password grant. Use this endpoint when a human user can supply interactive credentials directly; for non-interactive service accounts, use POST /auth/client-credentials instead. No prior authentication is required to call this endpoint. Both email and password must be present (non-null) in the request body — the server returns 400 if either is missing; Auth0 itself rejects blank or incorrect values with a 401. On success, returns a JSON object containing accessToken (a bearer token) and expiresIn (lifetime in seconds). Pass the token as Authorization: Bearer <accessToken> on subsequent requests.

post/auth/login

Headers

tenant-idstring

Not required and not used by this endpoint. This operation is marked tenant-agnostic, so the tenant-id presence check is skipped for it and the header value, if supplied, is not read by the handler.

Request body

emailstring required

User email address

passwordstring required

User password

Example request

{
  "email": "user@example.com",
  "password": "password"
}

Response

A JSON object containing a bearer access token (accessToken) and its lifetime in seconds (expiresIn).

accessTokenstring required

JWT access token

expiresIninteger required

Token expiration time in seconds

Example response

{
  "accessToken": "eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9...",
  "expiresIn": 86400
}