POST /api/auth/login/

Create an authenticated session.

Auth: not required.

---

Request

{
  "username": "tr100e",
  "passwordHash": "6c2a6f1f6f1edc1c6b7b5d3f7c6c8ce6e1f6bb3f4c1f9c0b0c2d5e8f7a9b3c4d"
}

Request fields

Field	Type	Required	Description
username	string	yes	Username; must be "tr100e"
passwordHash	string	yes	SHA-256 hex string, 64 characters long

Hash formula

SHA256(username + password + salt)

where salt is obtained from GET /api/auth/salt/.

Important: The salt is single-use and is invalidated after each login attempt. Request a new salt before trying to log in again.

passwordHash is checked against the powerUser password first, then against the user password. The accessLevel in the response corresponds to the password that matched.

If Web password verification is disabled by the webPwrPassEnable or webUserPassEnable setting, the device may grant the corresponding anonymous access level without a login request; determine that level using GET /api/auth/status/. A disabled powerUser takes precedence over a disabled user.

---

Response 200

{
  "authType": "Bearer",
  "token": "ej5k2pVg4Pd8yBdUqFPq8bdaStpeAZhyelpmkhtOivdK8r7E",
  "ttlSec": 60,
  "accessLevel": "user"
}

Response fields

Field	Type	Required	Description
authType	string	yes	Always "Bearer"
token	string	yes	48-character ASCII string [A-Za-z0-9]
ttlSec	number	yes	Session lifetime in seconds
accessLevel	string	yes	"user" or "powerUser"

---

Brute-force protection

• A shared failed-attempt counter is used across all interfaces (web, keypad, Modbus).
• After 5 failed attempts, all interfaces are locked out for 300 seconds.
• The counter resets after 300 seconds of inactivity or after a successful login.
• The state is stored in RTC backup registers and survives power-off.

---

Response 401 (incorrect password)

{
  "error": "ERROR_UNAUTHORIZED",
  "message": "3 attempts left"
}

Response 429 (lockout active)

{
  "error": "ERROR_LOCKED",
  "message": "Retry after 247 seconds"
}