Open a session
POST/api/v1/auth/login
Answers with the access token in the body and sets the refresh token as an
httpOnly cookie scoped to /api/v1/auth.
A caller who has been guessing is refused with captcha_required and the
challenge to solve, and repeats the request with the solution flattened
into it. See decision 0010.
Request
Responses
- 200
- 400
- 401
- 403
- 429
The session
Neither an email nor a password
Refused
A challenge to solve first
Guessing too often