Log in
Auth
Log in
Authenticate with email and password. On success the response sets the
aropay_session cookie (httpOnly, SameSite=Lax, 24 h TTL) and returns
the user.
If the account has TOTP enabled, no session is created yet; the
response instead carries requiresTotp: true and a short-lived
pendingToken to exchange at POST /auth/login/totp.
Limited to 10 attempts per 15 minutes per IP; 5 consecutive failures lock the account for 15 minutes.
POST
Log in