This message was deleted.

Login Step 1:

*GET* https://<instance>.<http://projects.oryapis.com/self-service/login/api|projects.oryapis.com/self-service/login/api>

Step 2:

POST https://<instance>.<http://projects.oryapis.com/self-service/login?flow={{flowID}}|projects.oryapis.com/self-service/login?flow={{flowID}}>

Reponse (status 400):

{
  "id": "535b6cb3-d9c9-4034-9619-9708258fa735",
  "organization_id": null,
  "type": "api",
  "expires_at": "2024-02-16T13:24:48.980468Z",
  "issued_at": "2024-02-16T12:54:48.980468Z",
  "request_url": "https://<instance>.projects.oryapis.com/self-service/login/api",
  "active": "code",
  "ui": {
    "action": "https://<instance>.projects.oryapis.com/self-service/login?flow=535b6cb3-d9c9-4034-9619-9708258fa735",
    "method": "POST",
    "nodes": [
      {
        "type": "input",
        "group": "default",
        "attributes": {
          "name": "csrf_token",
          "type": "hidden",
          "value": "",
          "required": true,
          "disabled": false,
          "node_type": "input"
        },
        "messages": [],
        "meta": {}
      },
      {
        "type": "input",
        "group": "default",
        "attributes": {
          "name": "identifier",
          "type": "hidden",
          "value": "jaceto@jeunupo.ec",
          "required": true,
          "disabled": false,
          "node_type": "input"
        },
        "messages": [],
        "meta": {
          "label": {
            "id": 1070002,
            "text": "E-Mail",
            "type": "info",
            "context": {
              "title": "E-Mail"
            }
          }
        }
      },
      {
        "type": "input",
        "group": "code",
        "attributes": {
          "name": "method",
          "type": "hidden",
          "value": "code",
          "disabled": false,
          "node_type": "input"
        },
        "messages": [],
        "meta": {}
      },
      {
        "type": "input",
        "group": "code",
        "attributes": {
          "name": "code",
          "type": "text",
          "required": true,
          "disabled": false,
          "node_type": "input"
        },
        "messages": [],
        "meta": {
          "label": {
            "id": 1070013,
            "text": "Login code",
            "type": "info"
          }
        }
      },
      {
        "type": "input",
        "group": "code",
        "attributes": {
          "name": "method",
          "type": "submit",
          "value": "code",
          "disabled": false,
          "node_type": "input"
        },
        "messages": [],
        "meta": {
          "label": {
            "id": 1070005,
            "text": "Submit",
            "type": "info"
          }
        }
      },
      {
        "type": "input",
        "group": "code",
        "attributes": {
          "name": "resend",
          "type": "submit",
          "value": "code",
          "disabled": false,
          "node_type": "input"
        },
        "messages": [],
        "meta": {
          "label": {
            "id": 1070008,
            "text": "Resend code",
            "type": "info"
          }
        }
      }
    ],
    "messages": [
      {
        "id": 1010014,
        "text": "An email containing a code has been sent to the email address you provided. If you have not received an email, check the spelling of the address and retry the login.",
        "type": "info"
      }
    ]
  },
  "created_at": "2024-02-16T12:54:48.989312Z",
  "updated_at": "2024-02-16T12:54:48.989312Z",
  "refresh": false,
  "requested_aal": "aal1",
  "state": "sent_email"
}

Hey @abundant-beach-2212. Glad to hear you're enjoying Ory. 👍 Login with code is a pretty new feature, and you've found a rough edge. The reason this endpoint returns 400 here is because of symmetry with other authentication methods (say password). In those flows, we return 400 for example when there's a form validation error (say password too short). The semantics being that another user action is required (submit a longer password) and that another

POST

to the same endpoint is expected to continue the flow. In the case of login-via-OTP-code, we return 400 here to indicate that another action is required to complete the login (user must input the code).

ok, thanks Arne. So I take it that currently there is no way to not get a 400 when sending the code, is that right?

Yes that's right. I feel like we should be returning a 201 or 202 code instead of 400 here. But for the moment, 400 means "go on". 😄

ahah ok, I'll feed that back to the team. Thanks again Arne!

I was looking at the same thing today and wondered why I got a 400 response at the Login with code. @refined-kangaroo-48640 indeed a 201 would be less confusing. But thanks for the clarification!