# POST /users/login
URL: https://developers.vsee.io/api/user-api/post/users/login
operationId: loginUser
Auth: Account Code Only — Only requires the X-AccountCode header. No token needed.

Login

Log user in and retrieve access token. **Public access** — no API token required.

Two login methods:
1. **Active user**: Use `username` and `password`
2. **Inactive user** (no password set): Use `email` and `email_token` sent to their email

After updating password via API, inactive users can use the active login method.

Parameters:
- X-AccountCode (header, string, required) — Account code

Request body (application/x-www-form-urlencoded):
- username (string, optional) — For active user login
- password (string, optional) — For active user login
- email (string, optional) — For inactive user login
- email_token (string, optional) — For inactive user login (token sent to email)

Example request:
```json
{
  "username": "member-201",
  "password": "example_password"
}
```

Responses:
- 200 — Successful login
```json
{
  "data": {
    "user_id": "201",
    "token": "18c31fa10afb6f0857c803eb01a2b392",
    "expiry": 1473822319,
    "created": 1473735919,
    "user_type": "200",
    "refresh_token": {
      "user_id": "201",
      "token": "6338a6e42f407acf39d07a63442efb9d",
      "expiry": 1476327919,
      "created": 1473735919
    },
    "user": {
      "id": "201",
      "code": "54bdf165f02c4a0fbaac2603ac1f0144",
      "first_name": "Lemuel",
      "last_name": "Eveline (201)test",
      "username": "member-201",
      "vseeid": "conciergedev+richard",
      "dob": "1960-01-01",
      "email": "an+user1@vsee.com",
      "gender": 2,
      "active": true,
      "tos": false,
      "phone": "800-555-5555",
      "subtype": ""
    }
  }
}
```
- 400 — Bad Request
```json
{
  "code": 404,
  "message": "Sorry, this page is not available."
}
```
- 401 — Unauthorized
```json
{
  "code": 404,
  "message": "Sorry, this page is not available."
}
```