Login
POST/api/auth/login
Authenticates a user and returns a Bearer token.
Local development credentials:
A deactivated user is refused with 401 before any two-factor code is sent. Wrong two-factor codes count toward the same failed sign-in lockout as wrong passwords.
Request
Responses
- 200
- 422
- 429
OK
Validation failed — the body is a field → messages map (Laravel shape) or the platform envelope with a stable machine-readable code. Fix the payload and resubmit.
Rate limited — platform limit is 1,000 requests/min; individual tokens may carry lower limits. Honor the Retry-After header before retrying. See the Rate Limits guide.