Skip to main content
POST
/
api
/
auth
/
login
Login with password or impersonation token
curl --request POST \
  --url https://your-instance.example.com/api/auth/login \
  --header 'Content-Type: application/json' \
  --data '
{
  "email": "ops@acme.example",
  "password": "CorrectHorseBatteryStaple!"
}
'
{
  "token": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJ1c2VySWQiOiI1Zjdi...",
  "refreshToken": "rt_64d2f9c5e8a1d4e001a0b1c2e6f7a8b9",
  "sessionConfig": {
    "enabled": true,
    "idleTimeoutMinutes": 30,
    "tokenExpiryHours": 8,
    "warningTimeMinutes": 2
  },
  "user": {
    "id": "5f7b1c2e8a1d4e0012c3b4a5",
    "email": "admin@acme.example",
    "fullName": "Acme Admin",
    "organizationId": "64a1b2c3d4e5f60012345678",
    "accessRole": "ADMIN"
  }
}

Body

application/json

Provide either password or impersonationToken with email.

​
email
string<email>
required

Login email; used to look up the user before credential check.

​
password
string

Plain-text password; verified via WorkOS when the user is migrated, otherwise via the local bcrypt hash. Mutually exclusive with impersonationToken.

​
impersonationToken
string

Single-use JWT issued by /api/auth/impersonate/{userId}; must carry the isImpersonation flag and match email. Mutually exclusive with password.

Response

Login successful

Returned by /api/auth/login and POST /api/auth/workos/callback on success. Contains access + refresh tokens, session config, and the resolved user.

​
token
string
required

JWT access token.

​
refreshToken
string
required
​
sessionConfig
object
required

Resolved session configuration returned alongside tokens. Mirrors the org-level idle-timeout / SSO renewal policy so the client can enforce it.

Example:
{
  "enabled": true,
  "idleTimeoutMinutes": 30,
  "tokenExpiryHours": 8,
  "warningTimeMinutes": 2,
  "idleTrackingEnabled": true,
  "ssoSilentRenewalEnabled": true,
  "ssoFallbackBehavior": "redirect",
  "passwordSilentRenewalEnabled": false,
  "passwordFallbackBehavior": "logout"
}
​
user
object
required

Compact User payload returned with auth tokens.

Example:
{
  "id": "5f7b1c2e8a1d4e0012c3b4a5",
  "email": "admin@acme.example",
  "fullName": "Acme Admin",
  "organizationId": "64a1b2c3d4e5f60012345678",
  "accessRole": "ADMIN",
  "conversationOpenPreference": "split"
}