Sign In
Auth Endpoints
Sign In
Authenticate a user with email and password
Sign In
Authenticates an existing user by email and password. Returns an access token, refresh token, and the user’s profile.
Rate limit: 25 requests per 5 minutes per IP. Exceeding it returns
Body Parameters
string
required
User’s registered email address.
string
required
User’s password.
Response
boolean
true on successful authentication.string
Short-lived JWT access token. Expires in 30 minutes.
string
Long-lived JWT refresh token. Expires in 30 days. Use it to request a new
access token when the current one expires.
object
The authenticated user’s profile.
Error Responses
User Not Found — 403
User Not Found — 403
Invalid Credentials — 403 or 400
Invalid Credentials — 403 or 400
403 when the user exists but has no password set (e.g. an OAuth-only account).The same code also arrives as 400 for a malformed request body — a missing or non-string email or password. Sign-in is the one auth route whose body validation reports auth/invalid-credentials rather than auth/invalid-body, so this code has two statuses. Branch on the status as well as the code if you need to tell “fix your request” from “these credentials will never work”.Wrong Password — 401
Wrong Password — 401
Server Error — 500
Server Error — 500
429 with the plain-text message Too many sign in attempts, please wait 5 minutes and no code.
See Also
useAuthhook —signInWithEmailAndPassword- Built-in Auth guide

