---
title: "Sign in"
method: POST
path: "/account/sign_in"
tags: ["Account"]
---

# Sign in

`POST /account/sign_in`

Step 3 of the OAuth flow. Trades the intent ID+token (received from the IdP callback) for an authenticated session. Sets the `session` cookie and returns a `csrf_token` that must be sent on all subsequent state-changing requests via `x-csrf-token` header.

## Request body

- SignIn
  - `id` string, required
  - `source` 'google' | 'github' | 'microsoft'
  - `token` string, required

## Response `200`

Authenticated session. The csrf_token must be echoed back as X-CSRF-Token on writes

- SessionInfo
  - `csrf_token` string, required
  - `email` string, required
  - `expiry` string, date-time, required

## Other responses

- `401` — Invalid credentials or expired intent
- `403` — User account locked or disabled
- `429` — Rate limit exceeded

---

[API](https://skmtc.net/laserdata/apis/laserdata-cloud-core-api.md) · [All operations](https://skmtc.net/laserdata/apis/laserdata-cloud-core-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/laserdata/laserdata-cloud-core-api/revisions/db81a447bba9/schema)