Skip to content
BookendBookend Docs

Sign in with email and password

POST
/v1/auth/login
curl --request POST \
  --url http://localhost:8080/v1/auth/login \
  --header 'Content-Type: application/json' \
  --data '{ "email": "example", "password": "example", "totpCode": "example" }'

Anonymous. Verifies the credentials and returns an access token (RS256 JWT, lifetime auth.access_token_minutes, default 15) plus a rotating refresh token and the user’s summary; keep both in memory, never in cookies. 401 for an unknown address, wrong password or inactive user (the message never says which), 422 when password sign-in is disabled by policy, 400 for a malformed body, 429 after too many attempts from one address.

Request Bodyrequired

Section titled “Request Bodyrequired”
Media typeapplication/json
object
email
string
password
string
totpCode

Required when auth.login_totp_enabled is on and the user has confirmed an authenticator.

null | string
Examplegenerated
{
  "email": "example",
  "password": "example",
  "totpCode": "example"
}

Responses

Section titled “Responses”

200

Section titled “200”

OK

Media typeapplication/json

Access token (15 min default) + rotating refresh token, returned in the body and held in memory by the SPA.

object
accessToken
required
string
accessExpiresAt
required
string format: date-time
refreshToken
required
string
refreshExpiresAt
required
string format: date-time
user
required
object
id
required
string format: uuid
email
required
string
displayName
required
string
roles
required
Array<string>
isActive
required
boolean
lastLoginAt
required
null | string format: date-time
totpEnrolled
required
boolean
Examplegenerated
{
  "accessToken": "example",
  "accessExpiresAt": "2026-04-15T12:00:00Z",
  "refreshToken": "example",
  "refreshExpiresAt": "2026-04-15T12:00:00Z",
  "user": {
    "id": "2489E9AD-2EE2-8E00-8EC9-32D5F69181C0",
    "email": "example",
    "displayName": "example",
    "roles": [
      "example"
    ],
    "isActive": true,
    "lastLoginAt": "2026-04-15T12:00:00Z",
    "totpEnrolled": true
  }
}