> For the complete documentation index, see [llms.txt](https://developers.docstudio.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://developers.docstudio.com/api-reference/authorization.md).

# Authorization

This document contains details for the /api/login endpoint, including the request body, response token, and status codes.

### Endpoint

| Property | Value        |
| -------- | ------------ |
| Method   | `POST`       |
| URL      | `/api/login` |

### Headers

<table><thead><tr><th width="164.333251953125">Header</th><th width="106.3333740234375">Required</th><th>Description</th></tr></thead><tbody><tr><td><code>Content-Type</code></td><td>Yes</td><td><code>application/json</code></td></tr><tr><td><code>Client-Device-Id</code></td><td>No</td><td>Client device identifier. When provided, the response includes <code>deviceId</code>.</td></tr></tbody></table>

```http
Content-Type: application/json
```

### Request body

| Field      | Type   | Required | Description         |
| ---------- | ------ | -------- | ------------------- |
| `login`    | string | Yes      | User login or email |
| `password` | string | Yes      | User password       |

### Request example

```http
POST /api/login
Content-Type: application/json
```

```json
{
  "login": "user@example.com",
  "password": "password"
}
```

### Response

{% hint style="info" %}
The response always contains a temporary authorization token. The `deviceId` field is returned only when the request includes the client device ID header; otherwise, this field is omitted.
{% endhint %}

<table><thead><tr><th width="104">Field</th><th width="95">Type</th><th>Description</th></tr></thead><tbody><tr><td><code>token</code></td><td>string</td><td>Temporary authorization token. Expires after 3 hours</td></tr><tr><td><code>deviceId</code></td><td>string</td><td>Device ID returned only when the request includes the client device identifier header</td></tr></tbody></table>

#### Response examples

When the request does not include the `Client-Device-Id` header, the response contains only the temporary authorization token. When the header is provided, the response also contains the generated `deviceId`.

**Response without `Client-Device-Id`**

```json
{
  "token": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9..."
}
```

**Response with `Client-Device-Id`**

```json
{
  "token": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...",
  "deviceId": "{deviceId}"
```

### Status codes

<table><thead><tr><th width="85.4444580078125">Code</th><th>Description</th></tr></thead><tbody><tr><td><code>200</code></td><td>Success. The response contains a temporary authorization token and, when requested, a device ID</td></tr><tr><td><code>401</code></td><td>Invalid login or password</td></tr><tr><td><code>403</code></td><td>Authenticated user lacks required access</td></tr></tbody></table>

### Related topics

* [Authentication and application tokens](/introduction/authentication-and-application-tokens.md)
* [API token security](/introduction/api-token-security.md)
* [Error Codes](/error-codes/error-handling-and-api-error-codes.md)