Client login (issue a bearer token)
POST/api/client/v1/auth/login
Native-client login. Verifies email + password through the same shared path as the browser login (rate limiting, account lockout, bot friction, bcrypt, security logging) and, on success, issues a bearer token the client sends on every later request as Authorization: Bearer <token>. Unlike the browser flow there's no cookie, no CSRF, and no idle-timeout. The rate limiter's captcha "challenge" (which a native client can't solve) is reported as a 429 back-off.
Request
Responses
- 200
- 400
- 401
- 429
- 500
A bearer token and the signed-in user.
Missing or malformed fields.
Invalid email or password.
Too many attempts; retry after the Retry-After header.
Server error.