v1

latestSwagger 2.02026-07-1760185352.5 KB

frontend

Submit a Login Flow

Use this endpoint to complete a login flow. This endpoint behaves differently for API and browser flows.

API flows expect application/json to be sent in the body and responds with HTTP 200 and a application/json body with the session token on success; HTTP 410 if the original flow expired with the appropriate error messages set and optionally a use_flow_id parameter in the body; HTTP 400 on form validation errors.

Browser flows expect a Content-Type of application/x-www-form-urlencoded or application/json to be sent in the body and respond with a HTTP 303 redirect to the post/after login URL or the return_to value if it was set and if the login succeeded; a HTTP 303 redirect to the login UI URL with the flow ID containing the validation errors otherwise.

Browser flows with an accept header of application/json will not redirect but instead respond with HTTP 200 and a application/json body with the signed in identity and a Set-Cookie header on success; HTTP 303 redirect to a fresh login flow if the original flow expired with the appropriate error messages set; HTTP 400 on form validation errors.

If this endpoint is called with Accept: application/json in the header, the response contains the flow without a redirect. In the case of an error, the error.id of the JSON response body can be one of:

session_already_available: The user is already signed in. security_csrf_violation: Unable to fetch the flow because a CSRF violation occurred. security_identity_mismatch: The requested ?return_to address is not allowed to be used. Adjust this in the configuration! browser_location_change_required: Usually sent when an AJAX request indicates that the browser needs to open a specific URL. Most likely used in Social Sign In flows.

More information can be found at Ory Kratos User Login and User Registration Documentation.

post/self-service/login

Query parameters

flowstring required

The Login Flow ID

The value for this parameter comes from flow URL Query parameter sent to your application (e.g. /login?flow=abcde).

Headers

X-Session-Tokenstring

The Session Token of the Identity performing the settings flow.

Cookiestring

HTTP Cookies

When using the SDK in a browser app, on the server side you must include the HTTP Cookie Header sent by the client to your server here. This ensures that CSRF and session cookies are respected.

Request body

UpdateLoginFlowBody required

Response

successfulNativeLogin

continue_withContinueWith[]

Contains a list of actions, that could follow this flow

It can, for example, this will contain a reference to the verification flow, created as part of the user's registration or the token of the session.

session_tokenstring

The Session Token

A session token is equivalent to a session cookie, but it can be sent in the HTTP Authorization Header:

Authorization: bearer ${session-token}

The session token is only issued for API flows, not for Browser flows!

Example response

{
  "session": {
    "identity": {
      "verifiable_addresses": [
        {
          "created_at": "2014-01-01T23:28:56.782Z",
          "updated_at": "2014-01-01T23:28:56.782Z",
          "verified": true,
          "via": "email"
        }
      ]
    }
  }
}