# Send Login Code

`POST /auth/login/code`

Sends a temporary one time code to the user that can be used during login flow.

If the user has a credential of kind `PasswordProtectedKey` a temporary one time code needs to be passed in the `loginCode` field. That's because the [Create User Login Challenge](https://docs-legacy.dfns.co/d/api-docs/authentication/login/initlogin) is unauthenticated and returns the encrypted private key of the user. So we need a first step to verify the identity of the user to prevent anybody from fetching the encrypted private key and trying to brute force it offline.

{% hint style="info" %}

* Request headers required. See [Request Headers](https://docs-legacy.dfns.co/d/advanced-topics/authentication/request-headers) for more information.
  {% endhint %}

## Required Permissions

None

## Request body

|                                               |          |                           |
| --------------------------------------------- | -------- | ------------------------- |
| `username` <mark style="color:red;">\*</mark> | `String` | Email address of the user |
| `orgId` <mark style="color:red;">\*</mark>    | `String` | ID of the target Org      |

### Example

```json
{
  "username": "jdoe@example.co",
  "orgId": "or-34513-nip9c-8bppvgqgj28dbodrc"
}
```

## Response

{% tabs %}
{% tab title="200" %}
**Success**

```json
{
    "message": "success"
}
```

{% endtab %}
{% endtabs %}

{% hint style="info" %}

* See [Common Errors](https://github.com/dfns/dfns-api-docs/blob/m/getting-started/errors.md#common-errors) for common errors.
* See [User Login Errors](https://github.com/dfns/dfns-api-docs/blob/m/getting-started/errors.md#user-login-errors) for user login errors.
  {% endhint %}