Log in

Authenticate with email and password. On success the response sets the aropay_session cookie (httpOnly, SameSite=Lax, 24 h TTL) and returns the user.

If the account has TOTP enabled, no session is created yet; the response instead carries requiresTotp: true and a short-lived pendingToken to exchange at POST /auth/login/totp.

Limited to 10 attempts per 15 minutes per IP; 5 consecutive failures lock the account for 15 minutes.

POST /auth/login

Log in

cURL

curl --request POST \
  --url https://aropay.aro.media/api/v1/auth/login \
  --header 'Content-Type: application/json' \
  --data '
{
  "email": "[e-mail]",
  "password": "correct-horse-battery-staple"
}
'

200

{
  "ok": true,
  "data": {
    "user": {
      "id": "ckusr0001abcd",
      "email": "[e-mail]",
      "name": "Ada Lovelace",
      "company": "Example Corp",
      "mustChangePassword": false,
      "totpEnabled": false,
      "lastLoginAt": "2026-08-13T09:00:00.000Z",
      "createdAt": "2026-06-01T12:00:00.000Z"
    }
  }
}

Body

application/json

email · string<email> · required

Account email address.

password · string · required

Account password.

Response

200

application/json

Session created, or TOTP step required.

ok · any · required

data · Session created · object · required

Session created

TOTP required

Show child attributes