# Login

Canonical page: https://docs.ovok.com/api/authentication/login

`POST /v2/auth/login`

Signs a user in with email and password for the project that owns a client application, and returns an access token and a refresh token. New integrations should use the tenant login routes (`/auth/tenant/Patient/login/start` and `/auth/tenant/Practitioner/login/start`) instead.

**Auth:** none. The email and password are the credential, and `clientId` names the project.
**Scope:** the project that owns the `ClientApplication` with the given `clientId`.

## Behaviour

- Ovok looks up the account by email in the client application's project. If a Patient and a Practitioner share the email in that project, one of them is picked and which one is not defined.
- The account type's login switch must be on: the project setting `PATIENT_LOGIN_ENABLED` or `PRACTITIONER_LOGIN_ENABLED`. Both default to on. It is checked once the password is right, so its 403 never tells which emails have an account.
- A wrong password and an unknown email give the same 401 `Invalid email or password.`, so the response does not tell you which one was wrong. An unknown `clientId` gives a 400.
- After 5 failed sign-ins for one email within 15 minutes, that email's sign-ins answer 429 with `Retry-After` for 15 minutes, the right password included, whether or not the email has an account. A successful sign-in resets the count.
- If Medplum's own login rate limit is hit, you get a 429 instead of a 401. Wait and retry.
- Callers without a token may send at most 10 requests per minute from one IP address.
- A successful login cancels a pending account deletion (`DELETE /auth/delete`).
- This route has no MFA step. Use the tenant login routes for users with MFA enrolled.
- The access token lasts one hour (`expiresIn` is in seconds). Use `POST /auth/refresh-token` to renew it.

## Example

```bash
curl -X POST 'https://api.sandbox.ovok.com/v2/auth/login' \
  -H 'Content-Type: application/json' \
  -d '{
    "email": "max.mustermann@example.com",
    "password": "Ex4mple-Passw0rd",
    "clientId": "c3499c27-2973-0a7f-807e-fb8676a92dcb"
  }'
```