---
title: "Login user"
method: POST
path: "/login"
tags: ["authentication"]
---

# Login user

`POST /login`

Logs in a user and creates a session.

## Request body

- object
  - `username` string, required — Username or email address.
  - `password` string, required — User password.

## Response `200`

User logged in successfully.

- LoginResponse
  - `user_id` string — Unique ID of the user on the site.
  - `first_name` string — The first name of the user (if any).
  - `last_name` string — The last name of the user (if any).
  - `display_name` string — The display name of the user (if any).
  - `role` string — The role type assigned to the user.
  - `avatar_urls` object — The avatar URLs of the user for each avatar size registered.
  - `email` string — The email address of the user.
  - `extras` object — Extra details added via the filter.
  - `dev_note` string — A message to developers.

## Other responses

- `400` — Bad request - invalid credentials.
- `403` — Authentication failed.

---

[API](https://skmtc.net/cocartapi/apis/cocart-jwt-authentication.md) · [All operations](https://skmtc.net/cocartapi/apis/cocart-jwt-authentication/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/cocartapi/cocart-jwt-authentication/revisions/2031b047ca5f/schema)