4.1 Authentication & Security
POST /user/login-with-password — Password Login
Validates password and returns whether two-factor authentication (2FA) is required along with a one-time login ticket.
Request Body (LoginForm):
| Parameter | Type | Required | Description |
|---|---|---|---|
email | string | Yes | Email address |
login_password | string | Yes | Login password (MD5 hash) |
Response (LoginResultVO):
| Field | Type | Description |
|---|---|---|
need_two_factor | boolean | Whether 2FA is required (always true) |
login_ticket | string | One-time login ticket to be returned during 2FA |
email | string | Masked email |
two_factor_methods | string[] | Available 2FA methods: EMAIL / AUTHENTICATOR / PASSKEY |
POST /user/login/2fa — Login 2FA Verification
Issues access_token and device_token upon successful verification.
Request Body (LoginVerifyForm):
| Parameter | Type | Required | Description |
|---|---|---|---|
email | string | Yes | Email address |
login_ticket | string | Yes | One-time ticket returned by password login |
method | string | Yes | 2FA method: EMAIL / AUTHENTICATOR |
validate_code | string | No | Email verification code (required when method=EMAIL) |
authenticator_code | string | No | Authenticator TOTP code (required when method=AUTHENTICATOR) |
Response (UserDetails):
| Field | Type | Description |
|---|---|---|
access_token | string | Access token |
device_token | string | Meta Edge device_token; same validity period as access_token |
expire | int64 | Expiration timestamp |
email | string | Email address |
POST /user/logout — User Logout
Request Body: { "id": "userID" }