Sign in

v1

latestOpenAPI 3.0.3Apache 2.02026-07-173769114.2 KB
public

Complete Login Flow with Username/Email Password Method

Use this endpoint to complete a login flow by sending an identity's identifier and password. This endpoint behaves differently for API and browser flows.

API flows expect application/json to be sent in the body and responds with HTTP 200 and a application/json body with the session token on success; HTTP 302 redirect to a fresh login flow if the original flow expired with the appropriate error messages set; HTTP 400 on form validation errors.

Browser flows expect application/x-www-form-urlencoded to be sent in the body and responds with a HTTP 302 redirect to the post/after login URL or the return_to value if it was set and if the login succeeded; a HTTP 302 redirect to the login UI URL with the flow ID containing the validation errors otherwise.

More information can be found at Ory Kratos User Login and User Registration Documentation.

post/self-service/login/methods/password

Query parameters

flowstring required

The Flow ID

Request body

csrf_tokenstring

Sending the anti-csrf token is only required for browser login flows.

identifierstring

Identifier is the email or username of the user trying to log in.

passwordstring

The user's password.

Response

loginViaApiResponse

session_tokenstring required

The Session Token

A session token is equivalent to a session cookie, but it can be sent in the HTTP Authorization Header:

Authorization: bearer ${session-token}

The session token is only issued for API flows, not for Browser flows!