Skip to main content
Version: v1.10

Implementing the Login Endpoint


Please read the Login Flow Documentation first!

In this document, you will learn how to implement the Login Endpoint using our ORY Hydra SDKs. The goal for this document is to have document this for multiple programming languages. If you are an expert in one of these languages, your help is highly appreciated in improving these docs!

Implementing the Login HTML Form#


The Login HTML Form cannot be a Single Page App (Client-side browser application) or a Mobile App! It has to be a server-side application with access to ORY Hydra's Admin Endpoint!

OAuth2 Login UI Screen

Accepting the Login Request#


Check out our reference implementation of this endpoint!

// This is the endpoint the user ends up at once she/he inserts their password and username and hits "Log in".'/login', csrfProtection, (req, res, next) => {
// The challenge is now a hidden input field, so let's take it from the request body instead
const challenge = req.body.challenge
// Let's check if the user provided valid credentials. Of course, you'd use a database or some third-party service
// for this! Alternatively, you can also use ORY Kratos:
if (!( === '' && req.body.password === 'foobar')) {
// Looks like the user provided invalid credentials, let's show the ui again...
res.render('login', {
csrfToken: req.csrfToken(),
challenge: challenge,
error: 'The username / password combination is not correct'
// Seems like the user authenticated! Let's tell hydra...
.acceptLoginRequest(challenge, {
// Subject is an alias for user ID. A subject can be a random string, a UUID, an email address, ....
subject: '',
// This tells hydra to remember the browser and automatically authenticate the user in future requests. This will
// set the "skip" parameter in the other route to true on subsequent requests!
remember: Boolean(req.body.remember),
// When the session expires, in seconds. Set this to 0 so it will never expire.
rememberFor: 3600
// Sets which "level" (e.g. 2-factor authentication) of authentication the user has. The value is really arbitrary
// and optional. In the context of OpenID Connect, a value of 0 indicates the lowest authorization level.
// acr: '0',
.then(({ body }) => {
// All we need to do now is to redirect the user back to hydra!
// This will handle any error that happens when making HTTP calls to hydra

Rejecting the Login Request#

// You can deny the login request at any point - for example if the system is currently undergoing maintenance
// or the user has been banned, is not allowed to use OAuth2 flows, and so on:
.rejectLoginRequest(challenge, {
error: 'user_banned',
errorDescription: 'You are not allowed to log in!'
.then(({ body }) => {
// All we need to do now is to redirect the browser back to hydra!
Last updated on by Anton Samoylenko