Sign in with email and password
POST/admin/auth/login
On success this sets the session cookie. The token is not in the body —
what comes back is the identity, the casinos this operator can reach, and
expires_in, which is how the console schedules its refresh without being
able to read an HttpOnly cookie.
When the account has TOTP enabled, the code rides in this same request as
totp_code. There is no intermediate token and no second step: a missing or
wrong code answers 401 two_factor_required, and the client re-sends the
whole body with the code filled in. totp_code also accepts a recovery code —
the client does not have to know which it is sending.
Request
Responses
- 200
- 400
- 401
- 403
- 429
Signed in — sets the sb_admin_session cookie
Malformed body, or email/password missing
invalid_credentials, or two_factor_required
account_suspended
too_many_requests — throttled by address and by IP