---
title: "Authorize user login"
description: "Use POST /auth to authenticate a registered user. The current public operation is User.auth."
canonical: https://docs.ordering.co/api-reference/guides/authorize-user-login/
---

# Authorize user login

> **API operation:** [Open the endpoint in Scalar](https://docs.ordering.co/api-reference/#tag/auth/POST/auth)

Use `POST /auth` to authenticate a registered user. The current public operation is `User.auth`.

The request supports login by email or cellphone. A password or one-time password is required according to the selected login mode. Additional fields, including notification, device-code, and verification fields, are conditional; follow the Scalar request schema rather than sending every available field.

Email and password example:

```javascript
const response = await ordering.users().auth({
  email: 'user@example.com',
  password: '[REDACTED]'
})
```

Cellphone login requires a number associated with a registered user and any country-code fields required by the selected project configuration.

This guide adds usage context to the exact public `POST /auth` operation. Scalar remains authoritative for request fields, authentication requirements, responses, and errors.

## OpenAPI reference

**Operation:** `POST /auth`

**Header parameters**

| Name              | Type   | Required | Description |
| ----------------- | ------ | -------- | ----------- |
| `x-forwarded-for` | string | No       | —           |
| `User-Agent`      | string | No       | —           |

**Request body fields**

| Name                    | Type   | Required |
| ----------------------- | ------ | -------- |
| `cellphone`             | any    | No       |
| `country_phone_code`    | string | No       |
| `device_code`           | string | No       |
| `email`                 | any    | No       |
| `guest_token`           | any    | No       |
| `notification_app`      | any    | No       |
| `notification_provider` | any    | No       |
| `notification_token`    | any    | No       |
| `one_time_password`     | any    | No       |
| `password`              | any    | No       |
| `platform`              | string | No       |
| `recaptcha_type`        | string | No       |
| `verification_code`     | any    | No       |

**Responses**

| Code | Description                           |
| ---- | ------------------------------------- |
| 200  | OK                                    |
| 400  | Bad Request (ErrorResponse)           |
| 401  | Unauthorized                          |
| 403  | Forbidden (ErrorResponse)             |
| 404  | Not Found                             |
| 429  | Too Many Requests (ErrorResponse)     |
| 500  | Internal Server Error (ErrorResponse) |
| 503  | Service Unavailable (ErrorResponse)   |

[Open this operation in the API reference](https://docs.ordering.co/api-reference/#tag/auth/POST/auth)