Login
curl --request POST \
--url https://api.example.com/v0/operators/loginimport requests
url = "https://api.example.com/v0/operators/login"
response = requests.post(url)
print(response.text)const options = {method: 'POST'};
fetch('https://api.example.com/v0/operators/login', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://api.example.com/v0/operators/login",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "POST",
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"net/http"
"io"
)
func main() {
url := "https://api.example.com/v0/operators/login"
req, _ := http.NewRequest("POST", url, nil)
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.post("https://api.example.com/v0/operators/login")
.asString();require 'uri'
require 'net/http'
url = URI("https://api.example.com/v0/operators/login")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Post.new(url)
response = http.request(request)
puts response.read_bodyOperators
Login
POST /v0/operators/login — Browser password login with an HTTP-only session cookie
POST
/
v0
/
operators
/
login
Login
curl --request POST \
--url https://api.example.com/v0/operators/loginimport requests
url = "https://api.example.com/v0/operators/login"
response = requests.post(url)
print(response.text)const options = {method: 'POST'};
fetch('https://api.example.com/v0/operators/login', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://api.example.com/v0/operators/login",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "POST",
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"net/http"
"io"
)
func main() {
url := "https://api.example.com/v0/operators/login"
req, _ := http.NewRequest("POST", url, nil)
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.post("https://api.example.com/v0/operators/login")
.asString();require 'uri'
require 'net/http'
url = URI("https://api.example.com/v0/operators/login")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Post.new(url)
response = http.request(request)
puts response.read_bodyThe browser offers password sign-in by email or username, and sign-in with an email code. This endpoint handles the password path. A successful login sets an HTTP-only
browser_session cookie. The response never contains a bearer token. The browser session is independent of CLI API keys and MCP OAuth grants, and expires after 30 days of inactivity.
Browser mutations must come from the configured frontend origin with x-tokenrip-browser-request: 1. The frontend sends them through its same-origin API relay.
Request body
| Field | Type | Required | Description |
|---|---|---|---|
email or alias | string | One required | The operator’s email address or username |
password | string | Yes | The operator’s password |
curl -X POST https://api.tokenrip.com/v0/operators/login \
-H "Content-Type: application/json" \
-H "Origin: https://tokenrip.com" \
-H "x-tokenrip-browser-request: 1" \
-c cookies.txt \
-d '{
"email": "[email protected]",
"password": "s3cr3t"
}'
Example response
{
"ok": true,
"data": {
"user_id": "u_abc123...",
"session_id": "7407f267-3aa0-4057-a8b6-9887075fd85c",
"expires_at": "2026-10-22T12:00:00.000Z"
}
}
Response fields
| Field | Type | Description |
|---|---|---|
user_id | string | Signed-in operator user ID |
session_id | string | Opaque browser session ID for safe same-browser mutations; not a credential |
expires_at | string | ISO 8601 inactivity expiry; foreground activity can renew it |
Errors
| Status | Error code | Condition |
|---|---|---|
| 400 | MISSING_PASSWORD | password is missing |
| 400 | MISSING_IDENTIFIER | Neither email nor alias was given |
| 401 | INVALID_CREDENTIALS | Unknown user or wrong password |
| 403 | INVALID_BROWSER_ORIGIN | The request did not come from the frontend origin with x-tokenrip-browser-request: 1 |
INVALID_CREDENTIALS is returned for both an unknown user and a wrong password, so the response never reveals whether an account exists.