User login
Authenticates with a password or email OTP and returns an access token.
Existing password clients may omit method; it defaults to password.
With method: otp, InsForge verifies and consumes the 6-digit sign-in
code. If the email is new and public signups are enabled, it then creates
a verified passwordless user. If public signups are disabled, a valid
code for an unknown email is consumed and the request returns 403.
For web clients, this endpoint sets an httpOnly refresh token cookie. For mobile/desktop/server clients, it returns refreshToken in the body.
Query Parameters
Client type determines how refresh tokens are returned:
- web: Refresh token stored in httpOnly cookie, csrfToken returned in response
- mobile/desktop/server: refreshToken returned directly in response body
web, mobile, desktop, server