> ## Documentation Index > Fetch the complete documentation index at: https://developers.liara.ir/llms.txt > Use this file to discover all available pages before exploring further. # Log in with a password > Exchanges your email address (or phone number) and password for an API token. If two-factor authentication is enabled on your account, send the second factor in the same request. This endpoint is rate limited. Too many requests return `429`. ## OpenAPI ````yaml /spec/platform-auth.yaml post /v1/login openapi: 3.0.1 info: title: Authentication & Account version: 1.0.0 description: >- Log in, issue API tokens, change or reset your password, set up two-factor authentication, verify your email address and phone number, and manage your account profile and billing contact details. servers: - url: https://api.liara.ir security: - bearerAuth: [] tags: - name: Login description: Exchange your credentials or a one-time code for an API token. - name: Registration description: Create a new account. - name: Password description: Change your password while logged in, or reset a forgotten one. - name: API Tokens description: Issue additional API tokens for your account. - name: Account description: Read and update your profile and billing contact details. - name: Two-Factor Authentication description: Set up and manage authenticator-app (TOTP) two-factor authentication. - name: Verification description: Verify, or change, your account's email address and phone number. paths: /v1/login: post: tags: - Login summary: Log in with a password description: >- Exchanges your email address (or phone number) and password for an API token. If two-factor authentication is enabled on your account, send the second factor in the same request. This endpoint is rate limited. Too many requests return `429`. operationId: login parameters: - $ref: '#/components/parameters/ExpiresIn' requestBody: required: true content: application/json: schema: type: object description: Send exactly one of `email` or `phone`. required: - password properties: email: type: string format: email description: Account email address. Required unless `phone` is sent. phone: $ref: '#/components/schemas/PhoneNumber' password: type: string maxLength: 250 twoFAType: $ref: '#/components/schemas/TwoFAType' totp: $ref: '#/components/schemas/TOTPCode' recoveryCode: $ref: '#/components/schemas/RecoveryCode' examples: password: summary: Email and password value: email: you@example.com password: withAuthenticatorCode: summary: With an authenticator-app code value: email: you@example.com password: twoFAType: totp totp: '123456' withRecoveryCode: summary: With a recovery code value: phone: '09120000000' password: twoFAType: recoveryCode recoveryCode: A1B2C3D4E5 responses: '200': description: Logged in. content: application/json: schema: $ref: '#/components/schemas/LoginResponse' example: api_token: fullname: نام نمونه avatar: https://example.com/avatar.png '400': description: >- The body is invalid, or two-factor authentication is enabled and `twoFAType` is missing (`two_fa_type_required`), or `totp` isn't numeric (`invalid_totp`). content: application/json: schema: $ref: '#/components/schemas/Error' examples: twoFARequired: summary: Second factor required value: statusCode: 400 error: Bad Request message: twoFAType is required. data: code: two_fa_type_required validation: summary: Invalid body value: statusCode: 400 error: Bad Request message: '"value" must contain at least one of [email, phone]' '401': description: >- The email address (or phone number) and password don't match an account. content: application/json: schema: $ref: '#/components/schemas/Error' example: statusCode: 401 error: Unauthorized message: Authentication failed. data: null '403': description: >- The second factor is wrong (`two_fa_totp_invalid`, `two_fa_recoveryCode_invalid`, `two_fa_validation_failed`), or the account has been inactive for a long time and its password must be reset first with `POST /v1/password/forgot` (`inactive_account`). content: application/json: schema: $ref: '#/components/schemas/Error' examples: wrongTotp: summary: Wrong authenticator code value: statusCode: 403 error: Forbidden message: twoFA authentication failed, totp is invalid. data: code: two_fa_totp_invalid inactiveAccount: summary: Inactive account value: statusCode: 403 error: Forbidden message: >- Your account has been inactive. Please reset your password to log in again. data: code: inactive_account '429': $ref: '#/components/responses/TooManyRequests' security: [] components: parameters: ExpiresIn: name: expiresIn in: query required: false description: How long the issued token stays valid. schema: type: string enum: - 1h - 1d - 7d - 30d - 180d - 1y default: 30d schemas: PhoneNumber: type: string pattern: ^09\d{9}$ description: Iranian mobile number in the form `09XXXXXXXXX`. example: '09120000000' TwoFAType: type: string description: >- Which second factor you're sending. Required when two-factor authentication is enabled on the account. enum: - totp - recoveryCode TOTPCode: type: string minLength: 6 maxLength: 6 description: >- 6-digit code from your authenticator app. Required when `twoFAType` is `totp`. RecoveryCode: type: string minLength: 10 maxLength: 10 description: >- One of your 10-character recovery codes. Required when `twoFAType` is `recoveryCode`. LoginResponse: type: object properties: api_token: type: string description: 'API token to send as `Authorization: Bearer `.' fullname: type: string avatar: type: string format: uri Error: type: object description: Standard error body. properties: statusCode: type: integer error: type: string description: HTTP status text. message: type: string description: What went wrong. data: type: object nullable: true description: >- Extra details. When present, `code` is a stable, machine-readable error code. properties: code: type: string responses: TooManyRequests: description: Too many requests. Wait and try again later. content: application/json: schema: $ref: '#/components/schemas/Error' example: statusCode: 429 error: Too Many Requests message: Too Many Requests data: null securitySchemes: bearerAuth: type: http scheme: bearer description: >- Send your API token as `Authorization: Bearer `. Tokens expire (30 days by default) and stop working when you change or reset your password. ```` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.