---
title: "Authenticate user"
method: POST
path: "/users/login"
tags: ["Users"]
---

# Authenticate user

`POST /users/login`

Validates email/password credentials via bcrypt. Returns a JWT access token
in the response body and sets a refresh token in an HTTP-only cookie.
Rate-limited to 5 requests per minute per IP.

## Request body

- object
  - `email` string, email, required
  - `password` string, password, required

## Response `202`

Authentication successful

- object
  - `message` string
  - `data` object
    - `token` string — JWT access token
    - `isSuperAdmin` boolean — Only present when user is super-admin (role_id=5)
    - `onboarding_status` string — Organization onboarding status (not present for super-admin)
    - `is_org_creator` boolean — Whether user is the first admin of the org (not present for super-admin)

## Other responses

- `401` — Invalid email or password
- `429` — Too many login attempts
- `500` — Internal server error

---

[API](https://skmtc.net/verifywise-ai/apis/verifywise-api.md) · [All operations](https://skmtc.net/verifywise-ai/apis/verifywise-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/verifywise-ai/verifywise-api/versions/c764f0a64a5e/schema)