Skip to main content
POST
Log in (dashboard user)
Verifies the email + password pair and opens a session by setting the httpOnly recurso_session cookie. Errors are deliberately generic — unknown email and wrong password both return the same 401 — so the endpoint cannot be used to enumerate accounts. If the account has MFA enabled, the response is a challenge instead of a session: complete it with POST /auth/login/mfa.

Example Request

Example Response

This endpoint powers the dashboard’s session auth. Server-to-server integrations should authenticate with an API key (Authorization: Bearer $API_KEY) instead — see Authentication.

Authorizations

Authorization
string
header
required

Body

application/json
email
string<email>
required
password
string<password>
required

Response

Authenticated. Sets recurso_session cookie.

user
object

A dashboard user account within a tenant.

tenant
object