---
title: "Authenticate (login)"
method: POST
path: "/api/cis/v1/auth/sessions"
tags: ["Auth"]
---

# Authenticate (login)

`POST /api/cis/v1/auth/sessions`

Create a new session with password credentials. If MFA is required,
`mfaRequired: true` is returned and the token is limited until MFA
verification via `/auth/factors/:id/verify`.

## Headers

- `x-tenant-id` string, required

## Request body

- CreateSessionRequest
  - `identityId` string, uuid, required
  - `password` string, password, required

## Response `200`

Session created

- SessionResponse
  - `sessionId` string, uuid
  - `accessToken` string — JWT (HS256 or ES256)
  - `expiresIn` integer — Token TTL in seconds
  - `refreshToken` string
  - `mfaRequired` boolean — True if MFA step is needed before full access

## Other responses

- `400` — No password factor enrolled
- `401` — Invalid credentials
- `403` — Identity blocked
- `404` — Resource not found

---

[API](https://skmtc.net/stalela/apis/stalela-cis-customer-identity-service-api.md) · [All operations](https://skmtc.net/stalela/apis/stalela-cis-customer-identity-service-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/stalela/stalela-cis-customer-identity-service-api/revisions/3065faad0b6b/schema)