Email and password sign-in

POST

/auth/login

const url = 'https://example.com/api/auth/login';
const options = {
  method: 'POST',
  headers: {'Content-Type': 'application/json'},
  body: '{"email":"hello@example.com","password":"example"}'
};

try {
  const response = await fetch(url, options);
  const data = await response.json();
  console.log(data);
} catch (error) {
  console.error(error);
}

curl --request POST \
  --url https://example.com/api/auth/login \
  --header 'Content-Type: application/json' \
  --data '{ "email": "hello@example.com", "password": "example" }'

Supabase password grant. Allowed only from trusted frontend origins (same allowlist as magic link). Magic link remains the default UX; password is optional for accounts that have one.

Request Body^required

application/json

object

email

required

string format: email

password

required

string

Responses

200

Access and refresh tokens

application/json

object

token

required

string

refresh_token

string

expires_in

integer

user

object

400

Invalid request

application/json

object

error

required

Human-readable error message

string

code

Stable machine-readable error code for client branching

string

fieldErrors

First validation message per field path

object

key

additional properties

string

issues

Structured validation issues (Zod)

Array<object>

object

path

required

string

message

required

string

retryAfter

Seconds until rate limit resets (429 responses)

number

401

Not authenticated

application/json

object

error

required

Human-readable error message

string

code

Stable machine-readable error code for client branching

string

fieldErrors

First validation message per field path

object

key

additional properties

string

issues

Structured validation issues (Zod)

Array<object>

object

path

required

string

message

required

string

retryAfter

Seconds until rate limit resets (429 responses)

number

reconnect

True if re-linking GitHub may fix the issue

boolean

403

Forbidden

application/json

object

error

required

Human-readable error message

string

code

Stable machine-readable error code for client branching

string

fieldErrors

First validation message per field path

object

key

additional properties

string

issues

Structured validation issues (Zod)

Array<object>

object

path

required

string

message

required

string

retryAfter

Seconds until rate limit resets (429 responses)

number

429

Rate limited

Email and password sign-in

Request Body required

Responses

200

400

401

403

429

Request Body^required