> ## Documentation Index
> Fetch the complete documentation index at: https://docs.cookiechimp.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Log in

> Exchange a user's email and password for an API token. This is the only
operation in this specification that does not require an
`Authorization` header — the API serves a few other public routes, such
as the widget and mobile SDK endpoints, that are not documented here.

The token returned is the user's default API token; calling this endpoint
again returns the same token rather than minting a new one.




## OpenAPI

````yaml post /auth
openapi: 3.1.0
info:
  title: CookieChimp API
  description: |
    API for CookieChimp.com.

    ## Request bodies

    Resource endpoints expect the resource wrapped under its own key, e.g.
    `{"category": {"name": "Analytics"}}` rather than a bare object.
    `PUT /password` wraps in `user`. `POST /auth` is the exception: it takes
    `email` and `password` at the top level.

    ## Response envelopes

    Listing endpoints — including `GET /groups` and `GET /accounts` — return
    `{"pagination": {...}, "data": [...]}`. Most single-resource endpoints
    return `{"data": {...}}`; a single group or account is returned unwrapped.
    Resource-deletion endpoints return `{"message": "..."}`; `DELETE /auth`
    returns an empty object.
  version: 1.2.0
servers:
  - url: https://cookiechimp.com/api/v1
security:
  - authorization: []
paths:
  /auth:
    post:
      tags:
        - Auth
      summary: Log in
      description: >
        Exchange a user's email and password for an API token. This is the only

        operation in this specification that does not require an

        `Authorization` header — the API serves a few other public routes, such

        as the widget and mobile SDK endpoints, that are not documented here.


        The token returned is the user's default API token; calling this
        endpoint

        again returns the same token rather than minting a new one.
      operationId: login
      requestBody:
        description: User credentials
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/LoginRequest'
      responses:
        '200':
          description: API token for the user
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/LoginResponse'
        '401':
          description: Invalid email or password
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/MessageError'
        '429':
          $ref: '#/components/responses/RateLimited'
      security: []
components:
  schemas:
    LoginRequest:
      type: object
      properties:
        email:
          type: string
          format: email
          description: The user's email address
        password:
          type: string
          format: password
          description: The user's password
      required:
        - email
        - password
      example:
        email: user@example.com
        password: correct-horse-battery-staple
    LoginResponse:
      type: object
      properties:
        token:
          type: string
          description: API token to send as a bearer token on subsequent requests
      example:
        token: 0mHFuvY2mCVfMBXbtNCPXA
    MessageError:
      type: object
      description: >-
        Returned by the auth and password endpoints, which use a single `error`
        string.
      properties:
        error:
          type: string
      example:
        error: Invalid Email or password.
    Error:
      type: object
      description: |
        The standard error envelope, used for authentication, authorization,
        pagination and not-found errors.
      properties:
        errors:
          type: array
          items:
            type: object
            properties:
              code:
                type: integer
              message:
                type: string
      example:
        errors:
          - code: 401
            message: Invalid API Key
  responses:
    RateLimited:
      description: |
        Too many requests. The general limit is 300 requests per 5 minutes per
        API token; the auth endpoints are throttled more tightly per IP.
      headers:
        Retry-After:
          description: Seconds until the current rate-limit window resets
          schema:
            type: integer
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/Error'
          example:
            errors:
              - code: 429
                message: Too many requests. Please retry later.
  securitySchemes:
    authorization:
      type: http
      scheme: bearer
      description: API token obtained from the login endpoint or the dashboard

````