login

Authenticates with email + password and starts a new session. Returns an AuthResponse whose token must be sent on subsequent requests as Authorization: Bearer <token>. Public (no auth required); throws on invalid credentials. If the account also has another verified sign-in method, the password must first be email-confirmed. First-party origins only: a browser page on any other origin is refused with HOSTED_SIGN_IN_REQUIRED (403) and must use the hosted sign-in redirect (CrowdyJS portal.signIn) instead; requests with no Origin header (native clients, scripts) are unaffected. Rate-limited per address and per client.

login(
  loginUserInput: LoginUserInput!
): AuthResponse!

Arguments

login.loginUserInput ● LoginUserInput! non-null input

Wraps the login credentials (email + password). (Argument name is non-standard but required.)

Type

AuthResponse object

Result of a successful login or registration: a session token plus the authenticated user.