---
title: "User login"
method: POST
path: "/api/auth/sessions"
tags: ["Client"]
---

# User login

`POST /api/auth/sessions`

Authenticates user and returns access token. For web clients, sets httpOnly refresh token cookie. For mobile/desktop/server clients, returns refreshToken in response body.

## Query parameters

- `client_type` 'web' | 'mobile' | 'desktop' | 'server'

## Request body

- object
  - `email` string, email, required
  - `password` string, required

## Response `200`

Login successful

- object
  - `user` UserResponse
    - `id` string, uuid
    - `email` string, email
    - `profile` object, nullable — User profile data (name, avatar_url, and custom fields)
      - `name` string
      - `avatar_url` string, uri
    - `metadata` object, nullable — System metadata (device ID, login IP, etc.)
    - `emailVerified` boolean
    - `providers` string[]
    - `createdAt` string, date-time
    - `updatedAt` string, date-time
  - `accessToken` string
  - `csrfToken` string, nullable — CSRF token for use with refresh endpoint (web clients only)
  - `refreshToken` string, nullable — Refresh token for mobile/desktop/server clients (null for web clients)

## Other responses

- `401` — Invalid credentials
- `403` — Email verification required

---

[API](https://skmtc.net/insforge/apis/insforge-authentication-api.md) · [All operations](https://skmtc.net/insforge/apis/insforge-authentication-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/insforge/insforge-authentication-api/versions/a935bb49f932/schema)