Sign in

POST

/api/auth/sign-in/username

curl --request POST \
  --url http://localhost:3000/api/auth/sign-in/username \
  --header 'Content-Type: application/json' \
  --data '{ "username": "sam", "password": "correct horse battery staple", "rememberMe": true }'

• Your Merran

With a username and password. Sets the session cookie that signed-in requests send. Scripts and tools like Home Assistant use an API key instead. Answers in Better Auth’s error shape.

Request Body^required

Media typeapplication/json

object

username

required

The username of the user

string

password

required

The password of the user

string

rememberMe

Remember the user session

boolean

callbackURL

URL to redirect to after sign in (also used as the redirect target for email verification when required)

string

Example

{
  "username": "sam",
  "password": "correct horse battery staple",
  "rememberMe": true
}

Responses

200

Success

Media typeapplication/json

object

redirect

required

Whether the client should follow the Location header. True when callbackURL was provided.

boolean

token

required

Session token for the authenticated session

string

url

The callbackURL echoed back so the client can redirect.

string

nullable

user

required

object

id

required

string

name

required

string

email

required

string

emailVerified

required

boolean

image

string

createdAt

required

string format: date-time

updatedAt

required

string format: date-time

username

string

displayUsername

string

role

string

banned

boolean

banReason

string

banExpires

string format: date-time

Example

{
  "redirect": false,
  "token": "sample-session-token",
  "url": null,
  "user": {
    "id": "0199e8b0-5a10-7a01-8b00-000000000001",
    "name": "Sam Rivera",
    "email": "sam@example.com",
    "emailVerified": false,
    "image": null,
    "createdAt": "2026-10-01T17:30:00.000Z",
    "updatedAt": "2026-10-01T17:30:00.000Z",
    "username": "sam",
    "displayUsername": "sam",
    "role": "admin",
    "banned": false
  }
}

400

Bad Request. Usually due to missing parameters, or invalid parameters.

Media typeapplication/json

object

message

required

string

Example ^generated

{
  "message": "example"
}

401

Unauthorized. Due to missing or invalid authentication.

Media typeapplication/json

object

message

required

string

Example ^generated

{
  "message": "example"
}

403

Forbidden. You do not have permission to access this resource or to perform this action.

Media typeapplication/json

object

message

string

Example ^generated

{
  "message": "example"
}

404

Not Found. The requested resource was not found.

Media typeapplication/json

object

message

string

Example ^generated

{
  "message": "example"
}

422

Unprocessable Entity. Validation error

Media typeapplication/json

object

message

string

Example ^generated

{
  "message": "example"
}

429

Too Many Requests. You have exceeded the rate limit. Try again later.

Media typeapplication/json

object

message

string

Example ^generated

{
  "message": "example"
}

500

Internal Server Error. This is a problem with the server that you cannot fix.

Media typeapplication/json

object

message

string

Example ^generated

{
  "message": "example"
}