Authenticate a human user with email and password
POST/auth/login
Exchanges a user's email address and password for a short-lived access token issued by Auth0's Resource Owner Password grant. Use this endpoint when a human user can supply interactive credentials directly; for non-interactive service accounts, use POST /auth/client-credentials instead. No prior authentication is required to call this endpoint. Both email and password must be present (non-null) in the request body — the server returns 400 if either is missing; Auth0 itself rejects blank or incorrect values with a 401. On success, returns a JSON object containing accessToken (a bearer token) and expiresIn (lifetime in seconds). Pass the token as Authorization: Bearer <accessToken> on subsequent requests.
Request
Responses
- 200
- 400
- 401
- 500
A JSON object containing a bearer access token (accessToken) and its lifetime in seconds (expiresIn).
Returned when email or password is missing from the request body; no call is made to Auth0.
Returned when Auth0 rejects the supplied credentials — the email/password combination is invalid or the user does not exist.
Returned when the call to Auth0's token endpoint fails unexpectedly (network error, unexpected upstream response) rather than a credential validation failure.