Skip to main content
Sign In
Authenticates an existing user by email and password. Returns an access token, refresh token, and the user’s profile.

Body Parameters

string
required
User’s registered email address.
string
required
User’s password.

Response

boolean
true on successful authentication.
string
Short-lived JWT access token. Expires in 30 minutes.
string
Long-lived JWT refresh token. Expires in 30 days. Use it to request a new access token when the current one expires.
object
The authenticated user’s profile.

Error Responses

403 when the user exists but has no password set (e.g. an OAuth-only account).The same code also arrives as 400 for a malformed request body — a missing or non-string email or password. Sign-in is the one auth route whose body validation reports auth/invalid-credentials rather than auth/invalid-body, so this code has two statuses. Branch on the status as well as the code if you need to tell “fix your request” from “these credentials will never work”.
Rate limit: 25 requests per 5 minutes per IP. Exceeding it returns 429 with the plain-text message Too many sign in attempts, please wait 5 minutes and no code.

See Also