# `auth.login`

<span class="badge">public</span>

**Log in with email and password**

Exchanges credentials for an access + refresh token pair. Send the access token as `Authorization: Bearer <token>` on every non-public call. Login is rate-limited per email+IP; repeated failures are throttled.

## Parameters

Passed by name in the `params` object.

| Name | Type | Required | Description |
|---|---|---|---|
| `email` | string | yes | Account email address |
| `password` | string | yes | Account password |

## Result

Returns `tokenPairResult`:

| Field | Type | Description |
|---|---|---|
| `access_expires_at *` | string | RFC3339 expiry of the access token |
| `access_token *` | string | Short-lived bearer token (15-minute TTL); send as Authorization: Bearer \<token\> |
| `refresh_token *` | string | Long-lived token used with auth.refresh to obtain a new pair |
| `user *` | `userDTO` |  |

## Errors

| Code | Message | When |
|---|---|---|
| `1001` | `unauthorized` | Missing/invalid credentials or a throttled login. |
| `2002` | `validation_failed` | Malformed request; see error.data. |

See the [error reference](/docs/errors) for the full catalog, including the authentication codes.

## Example

Request:

```json
{
  "jsonrpc": "2.0",
  "id": 1,
  "method": "auth.login",
  "params": {
    "email": "ada.lovelace@example.com",
    "password": "correct-horse-battery-staple"
  }
}
```

Response:

```json
{
  "jsonrpc": "2.0",
  "id": 1,
  "result": {
    "access_token": "eyJhbGciOiJIUzI1NiJ9.eyJzdWIiOiIwMThmM2E1Yy0xYzdhLTdlM2IifQ.c2ln",
    "refresh_token": "eyJhbGciOiJIUzI1NiJ9.eyJ0eXAiOiJyZWZyZXNoIn0.c2ln",
    "access_expires_at": "2026-03-14T09:41:53Z",
    "user": {
      "id": "018f3a5c-1c7a-7e3b-9c2a-3f4b5a6c7d8e",
      "email": "ada.lovelace@example.com",
      "is_admin": false
    }
  }
}
```

**curl**

```bash
curl -s https://peinture.gumeniuk.com/rpc \
  -H "Content-Type: application/json" \
  -d '{"jsonrpc":"2.0","id":1,"method":"auth.login","params":{"email":"ada.lovelace@example.com","password":"correct-horse-battery-staple"}}'
```

**JavaScript**

```js
const res = await fetch("https://peinture.gumeniuk.com/rpc", {
  method: "POST",
  headers: {
    "Content-Type": "application/json",
  },
  body: JSON.stringify({
    jsonrpc: "2.0", id: 1, method: "auth.login", params: {"email":"ada.lovelace@example.com","password":"correct-horse-battery-staple"},
  }),
});
const { result, error } = await res.json();
```

**Go**

```go
body := []byte(`{"jsonrpc":"2.0","id":1,"method":"auth.login","params":{"email":"ada.lovelace@example.com","password":"correct-horse-battery-staple"}}`)
req, _ := http.NewRequest("POST", "https://peinture.gumeniuk.com/rpc", bytes.NewReader(body))
req.Header.Set("Content-Type", "application/json")
resp, err := http.DefaultClient.Do(req)
```