> ## Documentation Index
> Fetch the complete documentation index at: https://api-docs.quivo.co/llms.txt
> Use this file to discover all available pages before exploring further.

# Legacy login (deprecated)

> [!WARNING]
>
> `POST /login` is deprecated. It keeps working until **31 January 2027**. From 1 February 2027, the API accepts integrations only with an API credential, and integrations that still use `POST /login` can no longer access the API. To switch, see [Migrate to OAuth 2.0 API credentials](https://api-docs.quivo.co/api-reference/migrate-to-oauth2.md).

Use this method only for existing integrations until you switch them. New integrations must use an API credential. See [Authentication](https://api-docs.quivo.co/api-reference/authentication.md).

> [!NOTE]
>
> All API examples in this guide use `${BASE_URL}` as a placeholder. Replace it with the correct base URL configured for the correct environment. For more information see [Environments page](https://api-docs.quivo.co/api-reference/environments.md).

## Obtain a session token

Exchange your static API key, username and password for a session token via `POST /login`:

> [tab] Request
>
> ```bash theme={null}
> curl -X POST "${BASE_URL}/login" \
>   -H "Content-Type: application/json" \
>   -H "X-Api-Key: <YOUR_STATIC_API_KEY>" \
>   -d '{
>     "username": "<YOUR_USERNAME>",
>     "password": "<YOUR_PASSWORD>"
>   }'
> ```

> [tab] Response
>
> A successful request returns `200 OK` with the session token:
>
> ```json theme={null}
> {
>   "Token": "<YOUR_SESSION_TOKEN>"
> }
> ```

## Use the session token

Send the session token in the `Authorization` header and the API key in the `X-Api-Key` header. Legacy calls use the paths without `/v2`:

```bash theme={null}
curl -X GET "${BASE_URL}/orders" \
  -H "X-Api-Key: <YOUR_STATIC_API_KEY>" \
  -H "Authorization: <YOUR_SESSION_TOKEN>"
```

## Session token expiration

Session tokens expire after one hour. When a call returns `401 Unauthorized`, call `POST /login` again and retry the call.

## Where to go next

> [card] [Migrate to OAuth 2.0 API credentials](https://api-docs.quivo.co/api-reference/migrate-to-oauth2.md)
>
> Move your integration to API credentials by 31 January 2027.

> [card] [Authentication](https://api-docs.quivo.co/api-reference/authentication.md)
>
> Get an access token with an API credential and call the `/v2` API.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.