Overview

Authenticate an existing customer with their email (or username) and password, and return a JWT that authenticates them on protected endpoints.

Example: A returning subscriber signs in with their email and password. On success you receive their profile and a token to use for the rest of their session.

📘

Invalid credentials are not disclosed

A wrong password, an unknown email, and an unknown username all return the same 404 — Invalid credentials! Please try again. The API never reveals whether an account exists.

🚧

Lockout

After repeated failed attempts (10 by default, within a 5-minute window) further attempts are temporarily blocked with a “Too many login attempts” error until the window passes.

Conditional Requirements