Email+password login; mints a session credential.
POST/v1/auth/login
Verifies the password and mints a fresh 7-day session credential. Failed logins are uniformly 401 unauthorized whether the email is unknown or the password wrong (equalized timing) — the endpoint is not an account-existence oracle.
Rate limit: 10 attempts / 5 minutes per (client IP, email).
No authentication is required for this endpoint.
Request
Responses
- 200
- 400
- 401
- 429
- 500
Session minted. data.session_token is the bearer; faucet_uusdc is never present on login.
Request was malformed or failed validation. The error.code field carries the
machine-readable reason; common values include invalid_request, invalid_json,
invalid_order_id, invalid_instrument_id, invalid_credential_id,
invalid_resolution, and operation-specific codes documented per endpoint.
Missing or invalid Authorization header.
Too many attempts inside the fixed rate-limit window (10 attempts / 5 minutes per key). Retry in a few minutes.
Unexpected server error. Includes a correlation_id; report it when filing a bug.