Request

Method and path	POST`/v1/auth/login`
Base URL	`https://api.boxline.dev`
Authentication	None. Anyone can call it.
Rate limit	Yes. See Rate limits for the numbers and headers.

Body

JSON with content-type: application/json. Required.

Name	Type	Default	Allowed values	Description
`email`required	`string`	–	–	Format: email.
`password`required	`string`	–	–	At least 8 characters.

curl -X POST "https://api.boxline.dev/v1/auth/login" \  -H "content-type: application/json" \  -d '{"email": "ada@example.com", "password": "correct-horse-battery"}'

import { Boxline } from "@boxline/sdk";const bx = new Boxline(); // reads BOXLINE_API_KEY and BOXLINE_API_URL// A console login (cookie): for browser apps made with new Boxline({ credentials: "include" }).const { user, project } = await bx.auth.login({ email: "ada@example.com", password: "correct-horse-battery" });

from boxline import Boxlinebx = Boxline()  # reads BOXLINE_API_KEY and BOXLINE_API_URLresult = bx.auth.login("ada@example.com", "correct-horse-battery")

Responses

200 OK

Logged in.

Headers

Set-Cookie: bx_session: HttpOnly, SameSite=Lax, Path=/ (and Secure on https).
RateLimit-Limit: Requests allowed in the current window of this route's limit. (Rate limits)
RateLimit-Remaining: Requests left in the current window. (Rate limits)
RateLimit-Reset: Seconds until the window starts again. (Rate limits)

Fields

Name	Type	Default	Allowed values	Description
`user`	`object`	–	–
`user.id`	`string`	–	–
`user.email`	`string`	–	–	Format: email.
`user.name`	`string \| null`	–	–	The user's name (signup
`organization`	`object \| null`	–	–	The login's current organization (null when the user belongs to none).
`organization.id`	`string`	–	–
`organization.name`	`string`	–	–
`organization.plan`	`string`	–	–
`organization.personal`	`boolean`	–	–	The user's personal organization (made at signup).
`organization.suspended`	`object \| null`	–	–
`organization.suspended.at`	`string`	–	–	Format: date-time.
`organization.suspended.reason`	`string \| null`	–	–
`organization.role`	`string \| null`	–	`owner`, `admin`, `developer`, `viewer`, `billing`	The caller's role (null with an API key).
`project`	`object \| null`	–	–	The login's current project (null when the user reaches none there).
`project.id`	`string`	–	–
`project.name`	`string`	–	–
`project.plan`	`string`	–	–	The project's organization's plan.
`project.orgId`	`string`	–	–
`project.concurrencyCap`	`integer \| null`	–	–	The project's own limit on running sessions, below the organization's (null: none).
`project.suspended`	`object \| null`	–	–
`project.suspended.at`	`string`	–	–	Format: date-time.
`project.suspended.reason`	`string \| null`	–	–

Response 200

{  "user": {    "id": "usr_Q2x9L0aPz7NmK3Jb",    "email": "ada@example.com",    "name": "Work account"  },  "organization": {    "id": "org_Hk2Lq8Zx0Vb5Nm1C",    "name": "Work account",    "plan": "free",    "personal": false,    "suspended": {      "at": "2026-09-29T10:00:00.000Z",      "reason": "…"    },    "role": "owner"  },  "project": {    "id": "prj_Hk2Lq8Zx0Vb5Nm1C",    "name": "Work account",    "plan": "free",    "orgId": "org_Hk2Lq8Zx0Vb5Nm1C",    "concurrencyCap": 0,    "suspended": {      "at": "2026-09-29T10:00:00.000Z",      "reason": "…"    }  }}

Errors

Errors have a matching HTTP status and the same body. code is stable, so check it in your code; message is for people. See Errors and request ids.

Status	Codes	When
401 Unauthorized	`unauthorized`	Missing or invalid API key.
429 Too Many Requests	`rate_limited`, `concurrency_limit`	Too many requests, or the organization's concurrent sessions (its plan's) or the project's concurrencyCap are in use.

Error body

{  "error": {    "code": "not_found",    "message": "session not found",    "requestId": "req_4fJx0aQm2Lk9Pz7N"  }}

These docs describe a beta API. Endpoints, fields and SDK methods may change before general availability; breaking changes will be listed in the changelog.