> ## Documentation Index
> Fetch the complete documentation index at: https://docs.drssed.app/llms.txt
> Use this file to discover all available pages before exploring further.

# POST /auth/login — Sign in with email or username/password

> Authenticate with email or username and password. Returns an access token and refresh token. Rate limited to 5 requests per minute.

Call `POST /auth/login` to authenticate an existing user and receive a JWT access token and refresh token. You can identify the user by either their email address or their username — provide one or the other along with their password. The returned tokens work identically to those issued by [POST /auth/guest](/api/auth/guest).

## Endpoint

| Field         | Value         |
| ------------- | ------------- |
| Method        | `POST`        |
| Path          | `/auth/login` |
| Auth required | No            |
| Rate limit    | 5 per minute  |

## Request body

Provide either `email` or `username` together with `password`. You do not need to supply both `email` and `username`.

<ParamField body="email" type="string">
  The user's email address. Required if `username` is not provided.
</ParamField>

<ParamField body="username" type="string">
  The user's username. Required if `email` is not provided.
</ParamField>

<ParamField body="password" type="string" required>
  The user's password.
</ParamField>

## Response fields

**Status: 200 OK**

<ResponseField name="access_token" type="string" required>
  JWT access token. Include this in the `Authorization: Bearer <token>` header on subsequent requests.
</ResponseField>

<ResponseField name="expires_in" type="integer" required>
  Number of seconds until the access token expires.
</ResponseField>

<ResponseField name="refresh_token" type="string" required>
  Token used to obtain a new access token when the current one expires. See [POST /auth/refresh](/api/auth/refresh).
</ResponseField>

## Example

```bash cURL theme={null}
curl --request POST \
  --url https://api.drssed.com/auth/login \
  --header 'Content-Type: application/json' \
  --data '{
    "email": "alex@example.com",
    "password": "s3cr3tpassword"
  }'
```

```json Response theme={null}
{
  "access_token": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...",
  "expires_in": 3600,
  "refresh_token": "drt_a1b2c3d4e5f6..."
}
```