# Sign in to the console with an API token

POST

/v1/auth/token-sign-in

```sh
curl --request POST \
  --url https://example.com/v1/auth/token-sign-in \
  --header 'Authorization: Bearer <token>'
```

The API token in `Authorization` is exchanged once for a browser session in the session cookie (HttpOnly; the same as a sign-in with an identity provider), so the browser never keeps the token. Only a person’s full key opens a session: a service account’s key, or a narrowed one (a `member` role, or one project), is refused `403 token-sign-in-not-allowed`. The session ends after its lifetime, or when the key expires if sooner. `403 token-sign-in-off` when the deployment doesn’t allow it (always mounted, so a console gets that answer); `400 token-sign-in-needs-an-api-token` when the request is already signed in by a session. `403 second-factor-required` in a workspace that requires a second factor at sign-in, which a token can’t give.

## Authorizations

- **[bearerAuth](https://docs.kindgi.com/v0.1.9/reference/api.md#bearerauth)**

## Responses

### 200

Signed in: the session cookie is set.

application/json

object

**userId**

required

The person now signed in.

string

\>= 1 characters

**expiresAt**

required

When the session ends at the latest: its lifetime, or the key’s expiry if sooner.

string format: date-time

##### Examplegenerated

```json
{
  "userId": "example",
  "expiresAt": "2026-04-15T12:00:00Z"
}
```

### 400

Signed in by a session, not an API token (`token-sign-in-needs-an-api-token`).

application/json

object

**error**

required

object

**code**

required

Stable machine-readable discriminant. Values match domain error codes (see `docs/API-ROUTE-CONVENTIONS.md` §4.3).

string

**message**

required

string

**details**

Optional, kind-specific.

object

**_key_**

additional properties

any

**requestId**

required

Server-assigned request id; also echoed via `X-Request-Id` header.

string

##### Examplegenerated

```json
{
  "error": {
    "code": "example",
    "message": "example",
    "details": {},
    "requestId": "example"
  }
}
```

### 401

Missing / malformed / expired / revoked bearer token.

application/json

object

**error**

required

object

**code**

required

Stable machine-readable discriminant. Values match domain error codes (see `docs/API-ROUTE-CONVENTIONS.md` §4.3).

string

**message**

required

string

**details**

Optional, kind-specific.

object

**_key_**

additional properties

any

**requestId**

required

Server-assigned request id; also echoed via `X-Request-Id` header.

string

##### Examplegenerated

```json
{
  "error": {
    "code": "example",
    "message": "example",
    "details": {},
    "requestId": "example"
  }
}
```

### 403

Not allowed here (`token-sign-in-off`), or not this key (`token-sign-in-not-allowed`): a service account’s, or a narrowed one; or the workspace requires a second factor (`second-factor-required`).

application/json

object

**error**

required

object

**code**

required

Stable machine-readable discriminant. Values match domain error codes (see `docs/API-ROUTE-CONVENTIONS.md` §4.3).

string

**message**

required

string

**details**

Optional, kind-specific.

object

**_key_**

additional properties

any

**requestId**

required

Server-assigned request id; also echoed via `X-Request-Id` header.

string

##### Examplegenerated

```json
{
  "error": {
    "code": "example",
    "message": "example",
    "details": {},
    "requestId": "example"
  }
}
```

### 409

A retry with the Idempotency-Key of a sign-in that succeeded: its session was in the cookie, which isn’t kept (`idempotency-key-replay-withheld`). Sign in again without the key.

application/json

object

**error**

required

object

**code**

required

Stable machine-readable discriminant. Values match domain error codes (see `docs/API-ROUTE-CONVENTIONS.md` §4.3).

string

**message**

required

string

**details**

Optional, kind-specific.

object

**_key_**

additional properties

any

**requestId**

required

Server-assigned request id; also echoed via `X-Request-Id` header.

string

##### Examplegenerated

```json
{
  "error": {
    "code": "example",
    "message": "example",
    "details": {},
    "requestId": "example"
  }
}
```

## See also

- [Error code `idempotency-key-replay-withheld`](https://docs.kindgi.com/v0.1.9/reference/errors.md#idempotency-key-replay-withheld)
- [Error code `second-factor-required`](https://docs.kindgi.com/v0.1.9/reference/errors.md#second-factor-required)
- [Error code `token-sign-in-needs-an-api-token`](https://docs.kindgi.com/v0.1.9/reference/errors.md#token-sign-in-needs-an-api-token)
- [Error code `token-sign-in-not-allowed`](https://docs.kindgi.com/v0.1.9/reference/errors.md#token-sign-in-not-allowed)
- [Error code `token-sign-in-off`](https://docs.kindgi.com/v0.1.9/reference/errors.md#token-sign-in-off)
- [Every error code](https://docs.kindgi.com/v0.1.9/reference/errors.md)