Session

post/authenticateexperimentalNo authentication

The only way a script obtains a session today. On success sets two cookies: `session` (httpOnly, carries the session id) and `csrf-token` (readable by JavaScript). Every mutating request afterwards - anything but GET, HEAD and OPTIONS - must send the `csrf-token` cookie's value back as the `X-CSRF-Token` header, or it is refused with 403; GET requests need only the `session` cookie. A cookie jar makes this workable from a script; a browser on another origin cannot call it (no CORS, `SameSite=Lax` cookies). Responds 400 when the body fails validation and 401 when the email or password is wrong.

Rate limit: 10 requests per 900 seconds.

Request body

Field	Type	Required	Constraints	Description
email	string	Yes	`format: "email"`	-
password	string	Yes	-	-

Example

{
  "email": "kamil@example.com",
  "password": "correct horse battery staple"
}

Responses

200Success
Field Type Required Constraints Description
user AuthenticatedUser Yes - The signed-in account, as returned by the endpoint that grants the session.
Example
```
{
  "user": {
    "uid": "uid-1",
    "email": "kamil@example.com",
    "name": "Kamil",
    "locale": "en"
  }
}
```
400The request body does not match the schema
No body.
401Not authenticated
No body.

Field	Type	Required	Constraints	Description
user	AuthenticatedUser	Yes	-	The signed-in account, as returned by the endpoint that grants the session.

Example request

curl -X POST 'https://mercastra.cloud/api/authenticate' \
  -H 'Content-Type: application/json' \
  -d '{"email":"kamil@example.com","password":"correct horse battery staple"}'

Sign in with email and password

Request body

Responses

Example request

End the caller's session

Responses

Example request