# Authentication

Canonical page: https://docs.ovok.com/java-sdk/authentication

## Sign in [#sign-in]

```java
LoginResult result = ovok.auth().login(new LoginCredentials(
        ProfileType.PRACTITIONER, "person@example.com", password));

if (result.status().equals("mfa-required")) {
    result = ovok.auth().verifyMfa(result.challenge(), mfaCode);
}
Session session = result.session();
```

Sign-in uses PKCE. `ProfileType` is `PATIENT`, `PRACTITIONER`, or `RELATED_PERSON`. `LoginResult.status()` is `signed-in` or `mfa-required`.

## Sessions and refresh [#sessions-and-refresh]

The client stores the session in its [session storage](/java-sdk/client-configuration#session-storage) and refreshes the access token before it expires. An authenticated request that answers 401 refreshes once and retries.

When the token service rejects the refresh token, the client clears the session and passes an `UnauthenticatedReason` to the `onUnauthenticated` callback.

A backend service signs in with client credentials instead; see [machine clients](/java-sdk/client-configuration#machine-clients).

Every method is in the [`AuthResource` reference](/java-sdk/reference/auth-resource).