Error
Authentication
Sign in
Answers a session, or — when the account has two-factor on — a short-lived challenge to exchange at /v1/auth/two-factor.
An unknown email and a wrong password produce the same 401 and take roughly the same time: the unknown-email path runs a throwaway bcrypt compare so latency does not leak whether an account exists.
Rate limited to 20 requests per 5 minutes per IP.
POST
Error
Response
Either a session or a two-factor challenge.