Exchange a local recovery token or username/password for an opaque session
POST/api/v1/session
The recovery token or password is accepted only in this JSON body and is never persisted by the session store. Browser requests are subject to same-origin Fetch Metadata and Origin checks. The returned credential is set as a host-only HttpOnly SameSite=Strict cookie.
Request
Responses
- 200
- 400
- 401
- 403
- 421
- 503
Authenticated and session cookie issued
Malformed JSON request
The opaque credential is absent, ambiguous, malformed, expired, revoked, or invalid
The browser mutation did not originate from this application, or the authenticated member lacks the required permission
The Host authority is not allowed by the loopback deployment profile
A required core dependency is unavailable; retry with bounded backoff