Sign in with a password
/login_with_password Authenticates a user with the email and password they set when registering. This is the first step
of signing in.
What you get back
On success, a token of type AUTH. An auth token doesn't authorize ordinary API calls. It only
reaches /identities and /access_token. Exchange it for an access token with
Create an access token before doing anything else. If
the user belongs to more than one identity, read the list first with
List linked identities and let them choose.
The token is valid for 5 minutes from last activity.
Expired passwords
A 409 means the password has expired. The response still carries a token, but a temporary one that
works only for Update a password. Send the user through a
password change and then sign them in again.
A 423 means the account is locked; a 410 means the token supplied has expired.
Other ways in
Verify with biometrics is an alternative to a password, and feeds the same access token exchange.
Workflow
Request
Request body
*Responses
Success
{ "token": "string", "tokenType": "AUTH", "identity": { "type": "CONSUMER", "id": "123456789" }, "credentials": { "type": "USER", "id": "987654321" }}