# Sign a customer in to a cart (/api/carts/login-cart)

`POST https://api.comecero.com/api/v1/carts/{cart_id}/login`

Checks a customer's username and password and, when they match, puts that customer on the cart. Tax, shipping and promotions are worked out again for the customer's details. For a limited token this is how a shopper signs in during checkout; the token can then use the customer's saved payment methods. Wrong details are `401` with code `invalid_login`; after too many failures the customer is locked for 10 minutes (`401`, code `account_locked`). Any token type may call it; a limited token only for a bound cart.

## Parameters

- `cart_id` (path, required): The id of the cart.
- `expand` (query): Comma-separated child objects to return in full instead of as a URL, for example `customer,payments`. Use dot notation for nested objects (`items.product`), up to four levels deep. A single object takes up to 12 paths; a list takes up to 2, applied to every item. Extra paths are dropped without an error. See [Expanding objects](https://docs.comecero.com/docs/basic-concepts/expanding-objects).
- `formatted` (query): When `true`, the object also has a `formatted` child with amounts and dates as display text in the shopper's language and currency (for example `$19.99` or `November 7, 2026`). The default is `false`. See [Localized formatting](https://docs.comecero.com/docs/basic-concepts/localized-formatting).
- `max_cross_sells` (query): How many cross-sell offers to return when `cross_sells` is expanded, 0 to 10. Default 3.
- `max_up_sells` (query): How many up-sell offers to return when `up_sells` is expanded, 0 to 10. Default 3.

Request body: the `cart_login_request` schema.

Responses: 200, 400, 401, 403, 404, 500.

Full schemas: operation `login_cart` in /openapi.json.