Complete User Login

POST /auth/login

Completes the login process and provides the authenticated user with their authentication token.

The type of credentials used to login is determined by the kind field in the nested objects (firstFactor and secondFactor). Supported credential kinds are:

• Fido2: Login challenge is signed by a user's signing device using WebAuthn.

• Key: Login challenge is signed by a user's private key.

• PasswordProtectedKey: Login challenge is signed by the decrypted user's private key that was sent during Create User Login Challenge step.

• Request headers required. See Request Headers for more information.

Required Permissions

Since this endpoint is not authenticated, the permissions apply to the application only.

Name	Conditions
Auth:Users:Read	Always Required

Request body

challengeIdentifier *	String	temporary authentication token returned by the Create User Login Challenge
firstFactor *	Object	first factor credential used to sign the challenge
secondFactor	Object	Optional second factor credential used to authenticate a user

Fido2 Credential

kind *	String	will always be Fido2
credentialAssertion *	Object
credentialAssertion.credId *	String	base64url encoded id of the credential returned by the user's WebAuthn client
credentialAssertion.clientData *	String	base64url encoded client data object returned by the user's WebAuthn client
credentialAssertion.authenticatorData *	String	base64url encoded authenticator data object returned by the user's WebAuthn client
credentialAssertion.signature *	String	base64url encoded signature returned by the user's WebAuthn client
credentialAssertion.userHandle *	String	base64url encoded userHandle returned by the user's WebAuthn client

Example

{
  "challengeIdentifier":"eyJ0e...fQNA",
  "firstFactor":{
    "kind":"Fido2",
    "credentialAssertion":{
      "credId":"c1QEdgnPLJargwzy3cbYKny4Q18u0hr97unXsF3DiE8",
      "clientData":"eyJ0eXBlIjoid2ViYXV0aG4uZ2V0IiwiY2hhbGxlbmdlIjoiTVdNME1tWTVZVFEwTURSaU56ZGhOVEZoTnpZNU9EUXdOV0k1WlRRNFkyUmhPRFppTkRrM1pUWXpPVEU1T0dZeU1EY3haakJqWXprNE1tUTVZelkxTUEiLCJvcmlnaW4iOiJodHRwczovL2FwcC5kZm5zLm5pbmphIiwiY3Jvc3NPcmlnaW4iOmZhbHNlfQ",
      "authenticatorData":"WT-zFZUBbJHfBkmhzTlPf49LTn7asLeTQKhm_riCvFgFAAAAAA",
      "signature":"MEUCIQDJ8G9J1NTjdoKx0yloYw45bpn6fJhcqCoUGiZuOU1IAQIgAtPt7S8FHFYW9OMHh3S5FVAxk-lhli-2lX22bBNSDog",
      "userHandle":"dXMtMmJhMGgtbHZwMnEtOHYxODYwcGNqMWJoNWlyaQ"
    }
  }
}

Key Credential and Password Protected Key Credential

kind *	String	Key or PasswordProtectedKey
credentialAssertion *	Object
credentialAssertion.credId *	String	base64url encoded id of the credential
credentialAssertion.clientData *	String	base64url encoded Client Data JSON string object that was signed with the user's private key
credentialAssertion.signature *	String	base64url encoded signature generated by signing the clientData JSON string object

Example

{
  "challengeIdentifier":"eyJ0e...fQNA",
  "firstFactor":{
    "kind":"Key", // can be PasswordProtectedKey as well
    "credentialAssertion":{
      "credId":"6Ca6tAOFTx2odyJBnCoRO-gPvfpfy0EOoOcEaxfxIOk",
      "clientData":"eyJ0eXBlIjoia2V5LmdldCIsImNoYWxsZW5nZSI6Ik1XTTBNbVk1WVRRME1EUmlOemRoTlRGaE56WTVPRFF3TldJNVpUUTRZMlJoT0RaaU5EazNaVFl6T1RFNU9HWXlNRGN4WmpCall6azRNbVE1WXpZMU1BIiwib3JpZ2luIjoiaHR0cHM6Ly9hcHAuZGZucy5uaW5qYSIsImNyb3NzT3JpZ2luIjpmYWxzZX0",
      "signature":"owt8WtpJT_6eEuw4UwdIX2HMMwENgk0SrI-RoCMPhx_9YMVpNKJGmJfHUusf_R1Mor9a_hinQVuXj4_XRdeJFSY2AySXSUk",
    }
  }
}

Responses

• See Common Errors for common errors.

• See User Login Errors for user login errors.

200

Success - a user authentication token

{
  "token": "eyJ0eX...bzrQakA"
}