> ## Documentation Index
> Fetch the complete documentation index at: https://mintlify.com/Arvo-AI/aurora/llms.txt
> Use this file to discover all available pages before exploring further.

# POST /api/auth/login

> Authenticate user with email and password

## Endpoint

```
POST /api/auth/login
```

Authenticates a user with their email and password credentials. Returns user information on successful authentication.

## Request Body

<ParamField body="email" type="string" required>
  User's email address
</ParamField>

<ParamField body="password" type="string" required>
  User's password (minimum 8 characters)
</ParamField>

## Response

<ResponseField name="id" type="integer">
  User's unique database ID
</ResponseField>

<ResponseField name="email" type="string">
  User's email address
</ResponseField>

<ResponseField name="name" type="string">
  User's display name (may be null)
</ResponseField>

## Example Request

```bash cURL theme={null}
curl -X POST http://localhost:5080/api/auth/login \
  -H "Content-Type: application/json" \
  -d '{
    "email": "user@example.com",
    "password": "mySecurePassword123"
  }'
```

```javascript JavaScript theme={null}
const response = await fetch('http://localhost:5080/api/auth/login', {
  method: 'POST',
  headers: {
    'Content-Type': 'application/json',
  },
  body: JSON.stringify({
    email: 'user@example.com',
    password: 'mySecurePassword123',
  }),
});

const data = await response.json();
console.log(data);
```

```python Python theme={null}
import requests

response = requests.post(
    'http://localhost:5080/api/auth/login',
    json={
        'email': 'user@example.com',
        'password': 'mySecurePassword123'
    }
)

data = response.json()
print(data)
```

## Example Response

<CodeGroup>
  ```json Success (200) theme={null}
  {
    "id": 12345,
    "email": "user@example.com",
    "name": "John Doe"
  }
  ```

  ```json Invalid Credentials (401) theme={null}
  {
    "error": "Invalid credentials"
  }
  ```

  ```json Missing Fields (400) theme={null}
  {
    "error": "Email and password are required"
  }
  ```

  ```json Server Error (500) theme={null}
  {
    "error": "Login failed"
  }
  ```
</CodeGroup>

## Security Notes

### Timing Attack Prevention

The login endpoint implements protection against timing attacks:

1. Password verification always runs, even if the user doesn't exist
2. A dummy bcrypt hash is used when the user is not found
3. This ensures consistent response times regardless of whether the user exists

### Password Verification

* Passwords are verified using bcrypt's secure comparison
* Original password is never stored or logged
* Only the bcrypt hash is stored in the database

## Error Handling

| Status Code | Description                                     |
| ----------- | ----------------------------------------------- |
| 200         | Authentication successful                       |
| 400         | Invalid request body or missing required fields |
| 401         | Invalid email or password                       |
| 500         | Internal server error                           |

## Frontend Integration

The frontend uses Auth.js (NextAuth.js) for authentication:

```typescript theme={null}
import { signIn } from "next-auth/react"

const result = await signIn("credentials", {
  email,
  password,
  redirect: false,
})

if (result?.error) {
  // Handle authentication error
  console.error("Login failed:", result.error)
} else if (result?.ok) {
  // Authentication successful
  // Auth.js automatically manages the session
  router.push("/dashboard")
}
```

## Related Endpoints

<CardGroup cols={2}>
  <Card title="Register" icon="user-plus" href="/api/auth/register">
    Create a new user account
  </Card>

  <Card title="Change Password" icon="key" href="/api/auth/token-management">
    Update user password
  </Card>
</CardGroup>