# Sign in to your account

> Sign in with your email address and password, finish with your second factor if you use one, and fix common sign-in problems.

Source: https://docs.coritan.com/account/sign-in/

In the dashboard:

- /login: https://www.coritan.com/login

Sign in to reach the dashboard, your services and your billing. You sign in with the email address and password you chose when you [created the account](/get-started/create-an-account/), and with a code from your phone if you use [two-factor authentication](/account/two-factor-authentication/).

## Before you begin

- A Coritan account and its password. If you have forgotten the password, [reset it](/account/password/#reset-a-forgotten-password) first.
- If two-factor authentication is on, your authenticator app, or one of your recovery codes.

## Sign in

1. Go to [coritan.com/login](https://www.coritan.com/login), or select **Sign in** at the top of any coritan.com page.
2. Enter your **Email address** and your **Password**.
3. If a verification check appears under the password, complete it.
4. Select **Sign in**.
5. If two-factor authentication is on, the page asks you to **Check your authenticator**. Type the six digits your app shows into **Authentication code**. The page signs you in as soon as you type the sixth digit. For a pasted code, select **Verify and sign in**.

   To use a recovery code instead, select **Use a recovery code instead** and type one of the codes you saved. Each recovery code works once.

## Result

The dashboard opens. If you were on another dashboard page when you were asked to sign in, that page opens instead. After a recovery code, a message tells you how many codes you have left: [make a new set](/account/two-factor-authentication/#make-new-recovery-codes) before they run out.

The browser stays signed in until you sign out. [Sign out and end sessions](/account/sessions/) explains how long that lasts and how to end it.

## Troubleshooting

`Invalid email or password. Check both and try again.`
: The email address or the password is wrong. The message is the same for both. Check them, or select **Forgot password?** to [reset the password](/account/password/#reset-a-forgotten-password).

`Account is suspended or closed`
: The account cannot sign in. [Contact support](/support/).

`Complete the verification check to continue.`
: The verification check under the password is not finished. Complete it, then select **Sign in** again.

`The verification check did not pass. Complete it and try again.`
: The check expired or failed. It resets on its own; complete it again.

`Too many authentication attempts. Please try again later.`
: Too many sign-in attempts failed from your network in the last minute. Wait a minute, then try again.

`That code is not right`
: The code is wrong or already used: each code works once. Wait for the next code in the app. If every code fails, check that your phone's clock sets itself automatically, because the codes depend on the time.

`Invalid or expired token`
: More than ten minutes passed between your password and your code. Select **Sign in to a different account** and sign in again.

`Too many requests for this action. Please wait and try again.`
: You tried more than ten codes in five minutes. Wait a few minutes before the next try.

You lost your phone and your recovery codes
: [Contact support](/support/) and say which account it is. Coritan staff can turn two-factor authentication off on the account. You then sign in with your password and set it up again on your new phone.

## Related

- [Change or reset your password](/account/password/)
- [Turn on two-factor authentication](/account/two-factor-authentication/)
- [Sign out and end sessions](/account/sessions/)

## With the API

Sign in with [`POST /auth/login`](/api/reference/client/authentication/#op-post-api-v1-auth-login), then send the `access_token` it returns as `Authorization: Bearer <token>`. [Make your first API request](/get-started/first-steps-with-the-api/) walks through it with curl.

```bash
curl -X POST https://api.coritan.com/api/v1/auth/login \
  -H "Content-Type: application/json" \
  -d '{"email": "alex@example.com", "password": "your password"}'
```

```json
{"access_token": "eyJhbGciOiJIUzI1NiIs...", "refresh_token": "eyJhbGciOiJIUzI1NiIs...", "token_type": "bearer", "expires_in": 1800}
```

`expires_in` is the access token's lifetime in seconds. When it runs out, exchange the `refresh_token` for a new pair with [`POST /auth/refresh`](/api/reference/client/authentication/#op-post-api-v1-auth-refresh) and the body `{"refresh_token": "..."}`. The answer has the same fields, with a new refresh token to keep.

When two-factor authentication is on, the sign-in answers with a pending token instead:

```json
{"mfa_required": true, "mfa_setup_required": false, "mfa_token": "eyJhbGciOiJIUzI1NiIs...", "expires_in": 600, "token_type": "bearer"}
```

Send the code to [`POST /auth/mfa/verify`](/api/reference/client/authentication-mfa/#op-post-api-v1-auth-mfa-verify) within ten minutes, with the `mfa_token` as the bearer token and `{"code": "123456"}` (or a recovery code) as the body. It answers with `access_token`, `refresh_token`, `token_type` and `expires_in`, plus `how` (`totp` or `recovery`) and `recovery_codes_left`. Every other endpoint refuses the `mfa_token` with `401` and `"error": "mfa_required"`.

[`GET /auth/turnstile`](/api/reference/client/authentication/#op-get-api-v1-auth-turnstile) says whether sign-in needs the verification check: `{"enabled": true, "site_key": "..."}`. When it is on, `POST /auth/login` also needs the `turnstile_token` the check produces, and answers `403` with `"error": "turnstile_failed"` without it.

| Status | `detail` | Meaning |
| --- | --- | --- |
| `401` | `Invalid email or password` | The email address or the password is wrong. |
| `403` | `Account is suspended or closed` | The account cannot sign in. |
| `403` | `{"error": "turnstile_failed", ...}` | The verification check is on and the token is missing or failed. |
| `401` | `That code is not right` | The second-factor code is wrong or already used. |
| `401` | `Invalid refresh token` | `POST /auth/refresh` was sent an access token. |
| `401` | `Token invalidated by password change` | The password changed after the token was issued. Sign in again. |
| `429` | `Too many authentication attempts. Please try again later.` | Too many failed sign-ins or refreshes from one address in a minute. `Retry-After` says when to try again. |

## API

- `POST /api/v1/auth/login`: Login (https://docs.coritan.com/api/reference/client/authentication/#op-post-api-v1-auth-login)
- `POST /api/v1/auth/mfa/verify`: Second step of signing in (https://docs.coritan.com/api/reference/client/authentication-mfa/#op-post-api-v1-auth-mfa-verify)
- `POST /api/v1/auth/refresh`: Refresh (https://docs.coritan.com/api/reference/client/authentication/#op-post-api-v1-auth-refresh)
- `GET /api/v1/auth/turnstile`: Turnstile config (https://docs.coritan.com/api/reference/client/authentication/#op-get-api-v1-auth-turnstile)