> ## Documentation Index
> Fetch the complete documentation index at: https://docs.falkordb.cloud/llms.txt
> Use this file to discover all available pages before exploring further.

# Sign in

> Sign into FalkorDB Cloud and receive session cookies.

Signs the user in. Send the request with HTTP Basic authentication (`Authorization: Basic <base64(user:password)>`). The response sets two `HttpOnly` cookies that authorize every other endpoint.

## Authorization

<ParamField header="Authorization" type="string" required>
  Basic authentication credentials: `Basic <base64(username:password)>`.
</ParamField>

## Response

### Cookies

<ResponseField name="omnistrate_token" type="string" required>
  Session JWT. Send it on every subsequent request. Expires after 1 hour (`Max-Age=3600`).
</ResponseField>

<ResponseField name="omnistrate_refresh_token" type="string" required>
  Refresh token used to obtain a new session token. Expires after 24 hours (`Max-Age=86400`).
</ResponseField>

Both cookies are issued with the following attributes:

```http 200 OK theme={null}
Set-Cookie: omnistrate_token=eyJhbGciOiJFZERTQSIsInR5cCI6IkpXVCJ9...; Path=/; HttpOnly; SameSite=Lax; Max-Age=3600; Domain=.falkordb.cloud; Secure
Set-Cookie: omnistrate_refresh_token=4610...; Path=/; HttpOnly; SameSite=Lax; Max-Age=86400; Domain=.falkordb.cloud; Secure
```

| Attribute  | Value             | Effect                                                                |
| ---------- | ----------------- | --------------------------------------------------------------------- |
| `HttpOnly` | —                 | The cookies are not readable from JavaScript.                         |
| `Secure`   | —                 | The cookies are only sent over HTTPS.                                 |
| `SameSite` | `Lax`             | The cookies are sent on top-level navigations and same-site requests. |
| `Domain`   | `.falkordb.cloud` | The cookies are scoped to FalkorDB Cloud and its subdomains.          |
| `Path`     | `/`               | The cookies are sent on every path.                                   |

<Warning>
  Because the cookies are `HttpOnly`, your application cannot read or store them itself. Browser clients should send requests with credentials included; server-side and CLI clients should persist and replay the `Set-Cookie` values.
</Warning>

## Sending the cookie

Browsers attach the cookies automatically as long as the request includes credentials:

```js theme={null}
await fetch("/api/instances", { credentials: "include" });
```

Other clients must store the cookies and send them back. With `curl`, use a cookie jar:

```bash theme={null}
curl -c cookies.txt -X POST \
  https://api.omnistrate.cloud/2022-09-01-00/resource-instance/user/signin \
  -u "$FALKORDB_EMAIL:$FALKORDB_PASSWORD"

curl -b cookies.txt https://api.omnistrate.cloud/...
```

## Session lifetime

The session token is valid for 1 hour. After it expires, use the refresh token to obtain a new session, or sign in again. The refresh token is valid for 24 hours; once it expires, the user must sign in with their credentials.

### Errors

| Status | Name             | Description                                |
| ------ | ---------------- | ------------------------------------------ |
| 400    | `bad_request`    | The request is malformed.                  |
| 401    | `auth_failure`   | The credentials are invalid.               |
| 500    | `failed_request` | The server failed to complete the sign-in. |

Error responses use the `application/vnd.goa.error` content type:

```json theme={null}
{
  "name": "bad_request",
  "id": "123abc",
  "message": "parameter 'p' must be an integer",
  "temporary": true,
  "timeout": false,
  "fault": false
}
```