Skip to main content
POST
Login

Body

application/json
username
string
required
password
string
required
device
string | null

Response

Successful Response

A password or One Tap sign-in: the access token, and who it belongs to.

The refresh token is never here -- it travels only in the httpOnly cookie. user is the account row in every mode but --no-auth, where it is the two claims the local identity carries; the routes answer with response_model_exclude_unset so that short form is not padded with nulls.

token
string
required
user
AuthUserOut · object
required