API Reference

Login with credentials

View Markdown

POST /api/auth/login

Validates password and sets a pending browser session. Requires TOTP verification to complete.

Operation IDlogin

Authentication

No authentication is required.

Request body

This request body is required.

Content typeapplication/json

requestobject

2 properties

usernamestringrequired

passwordstringrequired

Success response body

200Credentials valid. When TOTP is required, sets a pending browser session and returns the TOTP status flags. When TOTP is disabled (`auth.totp_required: false`), sets the authenticated browser session immediately and returns `{ authenticated: true }`.

Credentials valid. When TOTP is required, sets a pending browser session and returns the TOTP status flags. When TOTP is disabled (auth.totp_required: false), sets the authenticated browser session immediately and returns { authenticated: true }.

Content typeapplication/json

responseobject

4 properties

requires_totpboolean

True if the user has a TOTP secret and needs to verify it

needs_totp_setupboolean

True if the user has no TOTP secret and needs to enroll

can_restart_totp_setupboolean

True if an unverified TOTP enrollment exists and can be explicitly restarted

authenticatedboolean

True when TOTP is disabled and a full session was issued

Error responses

401Not authenticated

Not authenticated

Content typeapplication/json

responseobject

2 properties

errorstring

Example: NOT_FOUND

messagestring

Example: Resource not found

Example response

{
  "error": "AUTH_ERROR",
  "message": "Not authenticated"
}

429Too many requests

Too many requests

Content typeapplication/json

responseobject

2 properties

errorstring

Example: NOT_FOUND

messagestring

Example: Resource not found

Example response

{
  "error": "RATE_LIMITED",
  "message": "Too many failed TOTP attempts. Try again later."
}

Code examples

curl --request POST \
  --url 'https://your-envoy.example.com/api/auth/login' \
  --header 'Content-Type: application/json' \
  --data '{
  "username": "string",
  "password": "string"
}'

const response = await fetch("https://your-envoy.example.com/api/auth/login", {
  method: "POST",
  headers: {
    "Content-Type": "application/json",
  },
  body: JSON.stringify({
    "username": "string",
    "password": "string"
  }),
});

if (!response.ok) throw new Error(`Request failed: ${response.status}`);
const data = response.status === 204 ? null : await response.json();
console.log(data);