Sign in

v1

latestOpenAPI 3.0.3Apache 2.02026-07-1756158355.3 KB
frontend

Get Login Flow

This endpoint returns a login flow's context with, for example, error details and other information.

Browser flows expect the anti-CSRF cookie to be included in the request's HTTP Cookie Header. For AJAX requests you must ensure that cookies are included in the request or requests will fail.

If you use the browser-flow for server-side apps, the services need to run on a common top-level-domain and you need to forward the incoming HTTP Cookie header to this endpoint:

pseudo-code example
router.get('/login', async function (req, res) {
const flow = await client.getLoginFlow(req.header('cookie'), req.query['flow'])

res.render('login', flow)
})

This request may fail due to several reasons. The error.id can be one of:

session_already_available: The user is already signed in. self_service_flow_expired: The flow is expired and you should request a new one.

More information can be found at Ory Kratos User Login and User Registration Documentation.

get/self-service/login/flows

Query parameters

idstring required

The Login Flow ID

The value for this parameter comes from flow URL Query parameter sent to your application (e.g. /login?flow=abcde).

Headers

Cookiestring

HTTP Cookies

When using the SDK in a browser app, on the server side you must include the HTTP Cookie Header sent by the client to your server here. This ensures that CSRF and session cookies are respected.

Response

loginFlow

active'password' | 'oidc' | 'totp' | 'lookup_secret' | 'webauthn' | 'code' | 'passkey' | 'profile' | 'saml' | 'link_recovery' | 'code_recovery'

The active login method

If set contains the login method used. If the flow is new, it is unset. password CredentialsTypePassword oidc CredentialsTypeOIDC totp CredentialsTypeTOTP lookup_secret CredentialsTypeLookup webauthn CredentialsTypeWebAuthn code CredentialsTypeCodeAuth passkey CredentialsTypePasskey profile CredentialsTypeProfile saml CredentialsTypeSAML link_recovery CredentialsTypeRecoveryLink CredentialsTypeRecoveryLink is a special credential type linked to the link strategy (recovery flow). It is not used within the credentials object itself. code_recovery CredentialsTypeRecoveryCode

created_atstring date-time

CreatedAt is a helper struct field for gobuffalo.pop.

expires_atstring date-time required

ExpiresAt is the time (UTC) when the flow expires. If the user still wishes to log in, a new flow has to be initiated.

idstring uuid required

ID represents the flow's unique ID. When performing the login flow, this represents the id in the login UI's query parameter: http://<selfservice.flows.login.ui_url>/?flow=<flow_id>

identity_schemastring

IdentitySchema optionally holds the ID of the identity schema that is used for this flow. This value can be set by the user when creating the flow and should be retained when the flow is saved or converted to another flow.

issued_atstring date-time required

IssuedAt is the time (UTC) when the flow started.

oauth2_login_challengestring

Ory OAuth 2.0 Login Challenge.

This value is set using the login_challenge query parameter of the registration and login endpoints. If set will cooperate with Ory OAuth2 and OpenID to act as an OAuth2 server / OpenID Provider.

organization_idstring uuid4 nullable
refreshboolean

Refresh stores whether this login flow should enforce re-authentication.

request_urlstring required

RequestURL is the initial URL that was requested from Ory Kratos. It can be used to forward information contained in the URL's path or query for example.

requested_aal'aal0' | 'aal1' | 'aal2' | 'aal3'

The authenticator assurance level can be one of "aal1", "aal2", or "aal3". A higher number means that it is harder for an attacker to compromise the account.

Generally, "aal1" implies that one authentication factor was used while AAL2 implies that two factors (e.g. password + TOTP) have been used.

To learn more about these levels please head over to: https://www.ory.sh/kratos/docs/concepts/credentials

return_tostring

ReturnTo contains the requested return_to URL.

session_token_exchange_codestring

SessionTokenExchangeCode holds the secret code that the client can use to retrieve a session token after the login flow has been completed. This is only set if the client has requested a session token exchange code, and if the flow is of type "api", and only on creating the login flow.

{"stackTrail":"components:schemas:loginFlow:properties:state","oasType":"schema","type":"unknown","description":"State represents the state of this request:\n\nchoose_method: ask the user to choose a method to sign in with\nsent_email: the email has been sent to the user\npassed_challenge: the request was successful and the login challenge was passed."}
transient_payloadobject

TransientPayload is used to pass data from the login to hooks and email templates

typestring required

The flow type can either be api or browser.

updated_atstring date-time

UpdatedAt is a helper struct field for gobuffalo.pop.

Example response

{
  "identity_schema": "identity_schema",
  "requested_aal": "aal0",
  "active": "password",
  "created_at": "2000-01-23T04:56:07.000+00:00",
  "refresh": true,
  "return_to": "return_to",
  "session_token_exchange_code": "session_token_exchange_code",
  "type": "type",
  "issued_at": "2000-01-23T04:56:07.000+00:00",
  "request_url": "request_url",
  "expires_at": "2000-01-23T04:56:07.000+00:00",
  "oauth2_login_request": {
    "requested_access_token_audience": [
      "requested_access_token_audience",
      "requested_access_token_audience"
    ],
    "subject": "subject",
    "oidc_context": {
      "login_hint": "login_hint",
      "ui_locales": [
        "ui_locales",
        "ui_locales"
      ],
      "id_token_hint_claims": {
        "key": ""
      },
      "acr_values": [
        "acr_values",
        "acr_values"
      ],
      "display": "display"
    },
    "challenge": "challenge",
    "client": {
      "metadata": "",
      "token_endpoint_auth_signing_alg": "token_endpoint_auth_signing_alg",
      "client_uri": "client_uri",
      "jwt_bearer_grant_access_token_lifespan": "jwt_bearer_grant_access_token_lifespan",
      "jwks": "",
      "logo_uri": "logo_uri",
      "created_at": "2000-01-23T04:56:07.000+00:00",
      "registration_client_uri": "registration_client_uri",
      "allowed_cors_origins": [
        "allowed_cors_origins",
        "allowed_cors_origins"
      ],
      "refresh_token_grant_access_token_lifespan": "refresh_token_grant_access_token_lifespan",
      "registration_access_token": "registration_access_token",
      "client_id": "client_id",
      "token_endpoint_auth_method": "token_endpoint_auth_method",
      "userinfo_signed_response_alg": "userinfo_signed_response_alg",
      "authorization_code_grant_id_token_lifespan": "authorization_code_grant_id_token_lifespan",
      "authorization_code_grant_refresh_token_lifespan": "authorization_code_grant_refresh_token_lifespan",
      "client_credentials_grant_access_token_lifespan": "client_credentials_grant_access_token_lifespan",
      "updated_at": "2000-01-23T04:56:07.000+00:00",
      "scope": "scope",
      "request_uris": [
        "request_uris",
        "request_uris"
      ],
      "client_secret": "client_secret",
      "backchannel_logout_session_required": true,
      "backchannel_logout_uri": "backchannel_logout_uri",
      "client_name": "client_name",
      "policy_uri": "policy_uri",
      "owner": "owner",
      "skip_consent": true,
      "audience": [
        "audience",
        "audience"
      ],
      "authorization_code_grant_access_token_lifespan": "authorization_code_grant_access_token_lifespan",
      "post_logout_redirect_uris": [
        "post_logout_redirect_uris",
        "post_logout_redirect_uris"
      ],
      "grant_types": [
        "grant_types",
        "grant_types"
      ],
      "subject_type": "subject_type",
      "refresh_token_grant_refresh_token_lifespan": "refresh_token_grant_refresh_token_lifespan",
      "redirect_uris": [
        "redirect_uris",
        "redirect_uris"
      ],
      "sector_identifier_uri": "sector_identifier_uri",
      "frontchannel_logout_session_required": true,
      "frontchannel_logout_uri": "frontchannel_logout_uri",
      "skip_logout_consent": true,
      "refresh_token_grant_id_token_lifespan": "refresh_token_grant_id_token_lifespan",
      "implicit_grant_id_token_lifespan": "implicit_grant_id_token_lifespan",
      "client_secret_expires_at": 0,
      "implicit_grant_access_token_lifespan": "implicit_grant_access_token_lifespan",
      "access_token_strategy": "access_token_strategy",
      "jwks_uri": "jwks_uri",
      "request_object_signing_alg": "request_object_signing_alg",
      "tos_uri": "tos_uri",
      "contacts": [
        "contacts",
        "contacts"
      ],
      "response_types": [
        "response_types",
        "response_types"
      ]
    },
    "session_id": "session_id",
    "skip": true,
    "request_url": "request_url",
    "requested_scope": [
      "requested_scope",
      "requested_scope"
    ]
  },
  "transient_payload": "{}",
  "ui": {
    "nodes": [
      {
        "meta": {
          "label": {
            "context": "{}",
            "id": 6,
            "text": "text",
            "type": "info"
          }
        },
        "messages": [
          {
            "context": "{}",
            "id": 6,
            "text": "text",
            "type": "info"
          },
          {
            "context": "{}",
            "id": 6,
            "text": "text",
            "type": "info"
          }
        ],
        "attributes": {
          "autocomplete": "email",
          "maxlength": 1,
          "onclick": "onclick",
          "pattern": "pattern",
          "onclickTrigger": "oryWebAuthnRegistration",
          "label": {
            "context": "{}",
            "id": 6,
            "text": "text",
            "type": "info"
          },
          "type": "text",
          "required": true,
          "onload": "onload",
          "node_type": "input",
          "onloadTrigger": "oryWebAuthnRegistration",
          "name": "name",
          "disabled": true,
          "value": ""
        },
        "type": "text",
        "group": "default"
      },
      {
        "meta": {
          "label": {
            "context": "{}",
            "id": 6,
            "text": "text",
            "type": "info"
          }
        },
        "messages": [
          {
            "context": "{}",
            "id": 6,
            "text": "text",
            "type": "info"
          },
          {
            "context": "{}",
            "id": 6,
            "text": "text",
            "type": "info"
          }
        ],
        "attributes": {
          "autocomplete": "email",
          "maxlength": 1,
          "onclick": "onclick",
          "pattern": "pattern",
          "onclickTrigger": "oryWebAuthnRegistration",
          "label": {
            "context": "{}",
            "id": 6,
            "text": "text",
            "type": "info"
          },
          "type": "text",
          "required": true,
          "onload": "onload",
          "node_type": "input",
          "onloadTrigger": "oryWebAuthnRegistration",
          "name": "name",
          "disabled": true,
          "value": ""
        },
        "type": "text",
        "group": "default"
      }
    ],
    "method": "method",
    "action": "action",
    "messages": [
      {
        "context": "{}",
        "id": 6,
        "text": "text",
        "type": "info"
      },
      {
        "context": "{}",
        "id": 6,
        "text": "text",
        "type": "info"
      }
    ]
  },
  "updated_at": "2000-01-23T04:56:07.000+00:00",
  "oauth2_login_challenge": "oauth2_login_challenge",
  "organization_id": "organization_id",
  "id": "046b6c7f-0b8a-43b9-b35d-6489e6daee91",
  "state": ""
}