Session-based login (Legacy)

POST

/login

curl --request POST \
  --url https://auth.timetonic.com/login \
  --header 'Content-Type: application/json' \
  --data '{ "email": "hello@example.com", "userId": "example", "password": "example", "authCode": "example", "redirect": "https://example.com", "oidc_request_id": "example" }'

Authenticate user with credentials using web session. Returns JWT token for API access and handles pass-through parameters. Supports 2FA via authCode parameter and can return a pre-auth setup challenge when policy enforces enrollment.

Request Body^required

Media typeapplication/json

object

email

User email (required if userId not provided)

string format: email

userId

User identifier (required if email not provided)

string

password

required

string format: password

authCode

2FA code if required

string

/^\d{6}$/

redirect

URL to redirect after login

string format: uri

oidc_request_id

Pending OIDC authorization request to resume after login or enforced 2FA setup

string

Example^generated

{
  "email": "hello@example.com",
  "userId": "example",
  "password": "example",
  "authCode": "example",
  "redirect": "https://example.com",
  "oidc_request_id": "example"
}

Responses

200

Login successful

Media typeapplication/json

object

success

boolean

jwt

JWT access token

string

refresh_token

Refresh token

string

user

object

id

string format: uuid

email

string format: email

redirect

Redirect URL with token appended

string format: uri

form_post

HTML form body returned when OIDC response_mode is form_post

string

passThroughParameters

Parameters stored from initial bootstrap

object

key

additional properties

string

mustChangePassword

Whether user must change password

boolean

passwordResetToken

Token for password change (if mustChangePassword is true)

string

authenticationPolicies

Password policies for change form

object

twoFactorSetupRequired

Whether 2FA setup is enforced by policy

boolean

twoFactorData

2FA setup data if setup is required

object

secret

string

qr_uri

string

Example

{
  "success": true
}

401

Authentication failed

Media typeapplication/json

object

success

boolean

error

string

message

string

Example

{
  "success": false
}

403

2FA setup required before login can complete

Media typeapplication/json

object

success

boolean

error

string

Allowed values: 2fa_setup_required

2fa_setup_required

boolean

provisioning_uri

string format: uri

setup_token

string

oidc_request_id

string

Example

{
  "success": false,
  "error": "2fa_setup_required",
  "2fa_setup_required": true
}

422

Validation error

Media typeapplication/json

object

success

boolean

error

string

message

string

errors

object

key

additional properties

Array<string>

Example

{
  "success": false,
  "error": "validation_error",
  "message": "The given data was invalid",
  "errors": {
    "email": [
      "The email field is required."
    ]
  }
}