Sign in with email and password

POST/api/auth/sign-in/email

Request body

requiredapplication/json

emailstring<email>required

passwordstringrequired

callbackURLstring

rememberMeboolean

trustedDeviceTokenstring

Skips the TOTP challenge for a previously trusted device.

Responses

200

Signed in; Set-Cookie headers carry the access and refresh tokens. When two-factor is required, success is false and reason is two_factor_required.

successbooleanrequired

Allowed:true

tokenstring

Access token (also delivered via Set-Cookie in cookie mode).

refreshTokenstring

Rotation token for /api/auth/update-session.

redirectboolean

Whether url should be navigated to.

urlstring

Validated landing URL.

userUser

Show properties

idstring

emailstring<email>

namestring

imagestring

emailVerifiedboolean

400

Invalid body or untrusted callbackURL.

successbooleanrequired

Allowed:false

reasonstringrequired

401

Bad credentials.

successbooleanrequired

Allowed:false

reasonstringrequired

403

Cross-site request rejected by CSRF validation (Fetch Metadata / Origin). Same-origin and explicitly trusted origins are unaffected.

successbooleanrequired

Allowed:false

reasonstringrequired

Try it

Server

Base URLCustom base URLOverrides the selected server when set.

Bodyapplication/json

emailstring*passwordstring*callbackURLstringrememberMebooleantrustedDeviceTokenstringSkips the TOTP challenge for a previously trusted device.

Request

curl -X POST 'https://your-deployment.convex.site/api/auth/sign-in/email' \
  -H 'Content-Type: application/json' \
  -d '{
  "email": "user@example.com",
  "password": "string",
  "callbackURL": "string",
  "rememberMe": true,
  "trustedDeviceToken": "string"
}'

const response = await fetch("https://your-deployment.convex.site/api/auth/sign-in/email", {
  method: "POST",
  headers: {
    "Content-Type": "application/json"
  },
  body: "{\n  \"email\": \"user@example.com\",\n  \"password\": \"string\",\n  \"callbackURL\": \"string\",\n  \"rememberMe\": true,\n  \"trustedDeviceToken\": \"string\"\n}"
});

import requests

response = requests.post(
    "https://your-deployment.convex.site/api/auth/sign-in/email",
    headers={
        "Content-Type": "application/json"
    },
    data="{\n  \"email\": \"user@example.com\",\n  \"password\": \"string\",\n  \"callbackURL\": \"string\",\n  \"rememberMe\": true,\n  \"trustedDeviceToken\": \"string\"\n}",
)

Response

{
  "success": true,
  "token": "string",
  "refreshToken": "string",
  "redirect": true,
  "url": "string",
  "user": {
    "id": "string",
    "email": "user@example.com",
    "name": "string",
    "image": "string",
    "emailVerified": true
  }
}

{
  "success": false,
  "reason": "invalid_body"
}

{
  "success": false,
  "reason": "invalid_body"
}

{
  "success": false,
  "reason": "invalid_body"
}