Login with credentials

POST /api/auth/login

Validates password and sets a pending session cookie. Requires TOTP verification to complete.

Operation ID: login

Authentication

No authentication is required.

Request body

The request body is required.

application/json

• Type: object
• Properties:
  • username (string, required)
  • password (string, required)

Success responses

200

Credentials valid. When TOTP is required, sets a pending session cookie and returns the TOTP status flags. When TOTP is disabled (auth.totp_required: false), sets the full session cookie immediately and returns { authenticated: true }.

Content type: application/json

• Type: object
• Properties:
  • requires_totp (boolean) — True if the user has a TOTP secret and needs to verify it
  • needs_totp_setup (boolean) — True if the user has no TOTP secret and needs to enroll
  • can_restart_totp_setup (boolean) — True if an unverified TOTP enrollment exists and can be explicitly restarted
  • authenticated (boolean) — True when TOTP is disabled and a full session was issued

Error responses

401

Not authenticated

Content type: application/json

• Reference: Error
  • Type: object
  • Properties:
    • error (string)
      • Example: NOT_FOUND
    • message (string)
      • Example: Resource not found

Example:

{
  "error": "AUTH_ERROR",
  "message": "Not authenticated"
}

429

Too many requests

Content type: application/json

• Reference: Error
  • Type: object
  • Properties:
    • error (string)
      • Example: NOT_FOUND
    • message (string)
      • Example: Resource not found

Example:

{
  "error": "RATE_LIMITED",
  "message": "Too many failed TOTP attempts. Try again later."
}

Examples

cURL

curl --request POST \
  --url 'https://your-envoy.example.com/api/auth/login' \
  --header 'Content-Type: application/json' \
  --data '{
  "username": "string",
  "password": "string"
}'

JavaScript (fetch)

const response = await fetch('https://your-envoy.example.com/api/auth/login', {
  method: 'POST',
  headers: {
    'Content-Type': 'application/json',
  },
  body: JSON.stringify({
    "username": "string",
    "password": "string"
  }),
});
 
if (!response.ok) throw new Error(`Request failed: ${response.status}`);
const data = response.status === 204 ? null : await response.json();
console.log(data);