4.1.2 Password Login & Sessions
POST /user/login-with-password — Password Login
Validates the password and returns whether two-factor authentication (2FA) is required along with a one-time login ticket.
Request Body (LoginForm):
| Parameter | Type | Required | Description |
|---|---|---|---|
| string | Yes | Email address | |
| login_password | string | Yes | Login password (MD5 hash) |
Response (LoginResultVO):
| Field | Type | Description |
|---|---|---|
| need_two_factor | boolean | Whether 2FA is required (always true) |
| login_ticket | string | One-time login ticket to be returned during 2FA |
| string | Masked email | |
| two_factor_methods | string[] | Available 2FA methods: EMAIL / AUTHENTICATOR / PASSKEY |
POST /user/login/2fa — Login 2FA Verification
Issues access_token and device_token upon successful verification.
Request Body (LoginVerifyForm):
| Parameter | Type | Required | Description |
|---|---|---|---|
| string | Yes | Email address | |
| login_ticket | string | Yes | One-time ticket returned by password login |
| method | string | Yes | 2FA method: EMAIL / AUTHENTICATOR |
| validate_code | string | No | Email verification code (required when method=EMAIL) |
| authenticator_code | string | No | Authenticator TOTP code (required when method=AUTHENTICATOR) |
Response (UserDetails):
| Field | Type | Description |
|---|---|---|
| access_token | string | Access token |
| device_token | string | Meta Edge device_token; same validity period as access_token |
| expire | int64 | Expiration timestamp |
| string | Email address |
POST /user/logout — User Logout
Request Body: { "id": "userID" }