---
title: "Login with authentication token"
type: reference
method: GET
path: /rest-api/auth/{authToken}/login.do
tag: "Authentication"
---

# Login with authentication token

`GET https://YOUR-NETWORK-DOMAIN/rest-api/auth/{authToken}/login.do`

Authenticates a user using a one-time token previously obtained from POST /rest-api/auth/token.do. The token is consumed on first use and expires after one minute. On success, a session is established and the response includes a 'redirectUrl' to the main application page. The response format depends on request parameters: if a 'callback' query parameter is present, the response is JSONP (application/javascript); if 'json=true', the response is plain JSON; otherwise, a 302 redirect to /index.do is issued. Only the redirect mode signs the user in when called from another site: open the URL as a top-level navigation. The session cookie is SameSite=Lax, so a cross-site <script> or XHR call in the JSONP or JSON mode reports success but the browser drops the cookie, and the token is spent. Brute-force protection is active -- repeated failed attempts may block the requesting IP.

## Path params

| Name | Type | Required | Example | Description |
|---|---|---|---|---|
| `authToken` | string | yes | `a1b2c3d4e5f6a1b2c3d4e5f6a1b2c3d4` | One-time authentication token obtained from POST /rest-api/auth/token.do. Valid for one minute and consumed on first use. A random 128-bit value as 32 hex characters. |

## Query params

| Name | Type | Required | Example | Description |
|---|---|---|---|---|
| `json` | boolean | no | `true` | If true, returns the result as JSON instead of performing a redirect. Defaults to false. |

## Responses

- `200` — Authentication result (JSON/JSONP) containing 'success', 'redirectUrl', or 'error' fields
- `302` — Redirect to /index.do (default mode when neither 'callback' nor 'json' are specified)
- `400` — Bad request — invalid or missing parameters
- `404` — Not found — resource does not exist

## Example request

```bash
curl --request GET \
  --url 'https://YOUR-NETWORK-DOMAIN/rest-api/auth/a1b2c3d4e5f6a1b2c3d4e5f6a1b2c3d4/login.do?json=true'
```

Source: https://epom.com/ad-server/docs/api/authentication/get-auth-login