---
title: "aid_customers_login_post"
method: POST
path: "/accounts/{aid}/customers/login"
tags: ["password"]
---

# aid_customers_login_post

`POST /accounts/{aid}/customers/login`

Login a customer user, the caller must have scope
`write:accounts:/auth/users`.
If MFA is enabled on account, use
`write:accounts:/auth/users/no-mfa` to skip MFA.
scopes:
- write:accounts:/auth/users
- write:accounts:/auth/users/no-mfa

## Path parameters

- `aid` string, ^[PT]{1}\d{8}$, required

## Request body

- object
  - `email` string — **Required** if `ident_type` and `ident` is not set
  - `ident_type` 'phone_number' | 'email' — **Required** if `email` is not set
  - `ident` string — Email or phone_number, depending on the `ident_type`. **Required** if `email` is not set.
  - `audience` string, required — The unique identifier of the target API you want to access. The audience must be a grant associated with the client used when calling this resource.
  - `type` 'customer' | 'company', required — user type to login, required as users with different type can share email
  - `password` string, required — The customer pin or password. The caller must have scope `write:accounts:/auth/users` or `write:accounts:/auth/users/no-mfa` when password is included in the body

## Response `200`

Success

- AccessToken
  - `access_token` string, required — A JWT access token
  - `token_type` 'Bearer', required
  - `expires_in` integer, required — The lifetime in seconds of the access token. For example, the value "3600" denotes that the access token will expire in one hour from the time the response was generated.
  - `refresh_token` string — Token that can be used to request new tokens when the existing Access Token expire. You can only get a Refresh Token if the Access Token used in the request has scope: - `create:accounts:auth:refresh_token` and the `grant-type` is one of: - `authorization_code` - `password` **NOTE**: - A Single-Page Application should not ever receive a Refresh Token, this information is sensitive and should not be exposed client-side in a browser. - Refresh token must be stored securely by an application since they allow a user to remain authenticated essentially forever.

## Other responses

- `400` — Bad / Invalid request
- `401` — Access forbidden, invalid JWT token was used
- `403` — Forbidden
- `500` — Unexpected Error

---

[API](https://skmtc.net/dintero/apis/account-management-api.md) · [All operations](https://skmtc.net/dintero/apis/account-management-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/dintero/account-management-api/revisions/9b83a4199008/schema)