Skip to main content
POST
Login
The browser offers password sign-in by email or username, and sign-in with an email code. This endpoint handles the password path. A successful login sets an HTTP-only browser_session cookie. The response never contains a bearer token. The browser session is independent of CLI API keys and MCP OAuth grants, and expires after 30 days of inactivity. Browser mutations must come from the configured frontend origin with x-tokenrip-browser-request: 1. The frontend sends them through its same-origin API relay.

Request body

Example response

Response fields

Errors

INVALID_CREDENTIALS is returned for both an unknown user and a wrong password, so the response never reveals whether an account exists.