> ## Documentation Index
> Fetch the complete documentation index at: https://docs.insforge.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# User login

> Authenticates with a password or email OTP and returns an access token.
Existing password clients may omit `method`; it defaults to `password`.

With `method: otp`, InsForge verifies and consumes the 6-digit sign-in
code. If the email is new and public signups are enabled, it then creates
a verified passwordless user. If public signups are disabled, a valid
code for an unknown email is consumed and the request returns 403.

For web clients, this endpoint sets an httpOnly refresh token cookie.
For mobile/desktop/server clients, it returns refreshToken in the body.




## OpenAPI

````yaml https://raw.githubusercontent.com/InsForge/InsForge/main/openapi/auth.yaml post /api/auth/sessions
openapi: 3.0.3
info:
  title: Insforge Authentication API
  version: 2.0.0
  description: Authentication endpoints with separated auth and profile tables
servers: []
security: []
paths:
  /api/auth/sessions:
    post:
      tags:
        - Client
      summary: User login
      description: >
        Authenticates with a password or email OTP and returns an access token.

        Existing password clients may omit `method`; it defaults to `password`.


        With `method: otp`, InsForge verifies and consumes the 6-digit sign-in

        code. If the email is new and public signups are enabled, it then
        creates

        a verified passwordless user. If public signups are disabled, a valid

        code for an unknown email is consumed and the request returns 403.


        For web clients, this endpoint sets an httpOnly refresh token cookie.

        For mobile/desktop/server clients, it returns refreshToken in the body.
      parameters:
        - name: client_type
          in: query
          schema:
            type: string
            enum:
              - web
              - mobile
              - desktop
              - server
            default: web
          description: >
            Client type determines how refresh tokens are returned:

            - web: Refresh token stored in httpOnly cookie, csrfToken returned
            in response

            - mobile/desktop/server: refreshToken returned directly in response
            body
      requestBody:
        required: true
        content:
          application/json:
            schema:
              oneOf:
                - title: Password login
                  type: object
                  required:
                    - email
                    - password
                  properties:
                    method:
                      type: string
                      enum:
                        - password
                      default: password
                      description: May be omitted for backward compatibility
                    email:
                      type: string
                      format: email
                    password:
                      type: string
                - title: Email OTP login
                  type: object
                  required:
                    - method
                    - email
                    - otp
                  properties:
                    method:
                      type: string
                      enum:
                        - otp
                    email:
                      type: string
                      format: email
                      example: user@example.com
                    otp:
                      type: string
                      pattern: ^\d{6}$
                      description: 6-digit sign-in code
                      example: '123456'
                    name:
                      type: string
                      minLength: 1
                      maxLength: 100
                      description: Profile name used only when a new user is created
                      example: Ada Lovelace
      responses:
        '200':
          description: Login successful
          content:
            application/json:
              schema:
                type: object
                properties:
                  user:
                    $ref: '#/components/schemas/UserResponse'
                  accessToken:
                    type: string
                  csrfToken:
                    type: string
                    nullable: true
                    description: >-
                      CSRF token for use with refresh endpoint (web clients
                      only)
                  refreshToken:
                    type: string
                    nullable: true
                    description: >-
                      Refresh token for mobile/desktop/server clients (null for
                      web clients)
        '400':
          description: >-
            Invalid input or invalid, expired, consumed, or attempt-limited
            sign-in code
        '401':
          description: Invalid password credentials
        '403':
          description: >-
            Email verification required, or public signups are disabled for a
            verified unknown email
        '429':
          description: Too many OTP verification attempts
components:
  schemas:
    UserResponse:
      type: object
      properties:
        id:
          type: string
          format: uuid
        email:
          type: string
          format: email
        profile:
          type: object
          nullable: true
          additionalProperties: true
          description: User profile data (name, avatar_url, and custom fields)
          properties:
            name:
              type: string
            avatar_url:
              type: string
              format: uri
        metadata:
          type: object
          nullable: true
          additionalProperties: true
          description: System metadata (device ID, login IP, etc.)
        emailVerified:
          type: boolean
        providers:
          type: array
          items:
            type: string
        createdAt:
          type: string
          format: date-time
        updatedAt:
          type: string
          format: date-time

````