Log in a platform user
Authenticates a customer with their email and password and, on success, mints them an access token exactly like POST /platform/users/{user_id}/token — use this to build your own login form or custom auth flow on your white-label platform, instead of sending customers to the hosted login page. REST-only: this is the one White-Label Platform API operation with no MCP equivalent, since credentials should never travel through an MCP tool call. Rate-limited per IP + email. Every failure — unknown email, wrong password, or an email outside your scope — returns the exact same generic 401 message, so a caller can never use the response to guess which accounts exist. Required scope: platform:write. Requires white-label platform access (a reseller workspace with the white-label entitlement, or a platform admin acting from a root workspace) plus a live owner/admin membership in the calling credential’s own workspace — see White Label API.
Authorizations
API key (fam_..., created under Settings → API Keys) or an OAuth 2.0 access token (fam_at_...). Keys can be restricted to scopes such as assistants:read, calls:write, campaigns:write, automations:read, dashboards:read, dashboards:write, leads:write, segments:write, phone_numbers:write, sip_trunks:write, knowledge:write, voices:read, billing:read, settings:write, platform:read, platform:write; a *:write scope implies the matching *:read. Automation and dashboard endpoints also accept the legacy calls:* scope. Keys without scope restrictions have full access.
Response
The minted token (shown once).