> For the complete Lynkow documentation index in agent-friendly format, see [llms.txt](/llms.txt).

# Log a storefront customer in

**Publié le** : 2026-08-19
**Catégorie** : Commerce

## `POST /customers/login`

**Log a storefront customer in**

Authenticates by email plus password and issues a stateless session token. Any
failure (unknown email, an unclaimed guest row with no password, a wrong password, or
an unverified row) returns ONE uniform 401 with no field-level oracle, and every branch
does an equal amount of scrypt work so there is no response-time side channel
(no user enumeration). A booking the buyer makes while signed in appears in `me` right
away. `me`'s retro-link inbox-control gate (a guest booking merely tied to the email
stays hidden until the email is verified) is now unreachable from a login-issued
session, since this method refuses an unverified row; it stays as defense in depth.
Behind the
publishable key, the `customer_accounts` flag, and the
customer-auth rate-limit bucket. Five failures for one `(site, email)` pair add a
15-minute account-scoped backoff without affecting another site or email. Returns
200 with `{ customer, token }`.

> **Note:** This endpoint requires the e-commerce feature to be enabled on your site.

### Request Body

Content-Type: `application/json`

| Field | Type | Required | Description |
| --- | --- | --- | --- |
| `email` | string | Yes | Required. Valid email address |
| `password` | string | Yes | Required. 1-100 characters |


### Responses

| Status | Description |
| --- | --- |
| `200` | Successful response |
| `401` | Missing or invalid storefront publishable key |
| `402` | The site subscription does not currently permit this operation |
| `403` | The storefront key origin is not allowed |
| `404` | Site, resource, or commerce feature not found |
| `422` | Validation error |


---