Skip to content
LogoLogo

How to authenticate with a password

This guide shows you how to get an access token from an email address and a password.

1. Create a session

mutation {
  sessionCreate(input: {
    email: "user@example.com"
    password: "secure-password"
  }) {
    session {
      accessToken
      refreshToken
      expiresAt
      aal
      user {
        mfa { required enrolled }
      }
    }
  }
}

The session is at AAL1. When user.mfa.required is true, verify a code from an authenticator app before you call other operations. See How to set up MFA.

2. Send the token

Authorization: Bearer <accessToken>

3. Refresh before it expires

The expiresAt field gives the time at which the access token expires.

mutation {
  sessionRefresh(input: { refreshToken: "v1.refresh-token..." }) {
    session { accessToken refreshToken expiresAt }
  }
}

The API invalidates the earlier refresh token. This mutation needs no Authorization header.