Log in

Sets the session cookie. When the account has TOTP enrolled and no totpCode was supplied -- or the code was replayed -- the answer is 401 MFA_REQUIRED and NO cookie; resend the same body with the code. There is no intermediate ticket, because a ticket is a second session-shaped secret with its own theft story. Every failure below a correct password is one indistinguishable 401 that costs one Argon2id verification, including for an address that was never registered.

curl -X POST "https://example.com/console/v1/sessions" \  -H "Authorization: Bearer apf_v2_tu_credencial" \  -H "Content-Type: application/json" \  -d '{    "email": "string",    "password": "string"  }'

{  "schemaVersion": "console.1",  "requestId": "d385ab22-0f51-4b97-9ecd-b8ff3fd4fcb6",  "userId": "2c4a230c-5085-4924-a3e1-25fb4fc5965b",  "email": "string",  "mfaEnrolled": true,  "memberships": [    {      "organizationId": "7bc05553-4b68-44e8-b7bc-37be63c6d9e9",      "organizationName": "string",      "memberRole": "OWNER"    }  ]}