# Log in a customer (/api/customers/login-customer)

`POST https://api.comecero.com/api/v1/customers/login`

Signs a customer in with the `username` and `password` set on the customer. Three ways to call it: - With a limited token: on success that token is tied to the customer. It can then read and change the customer, their payment methods, orders, subscriptions and invoices, and use `me` as the customer id. No new token is returned. - With no token: send `account_id` (and `test=true` for a test customer) in the query. A new limited token for the customer comes back in `auth`. - With a secret token: you must send the shopper's `user_ip_address` in the query, and the token needs permission to create auths and update customers. A new limited token for the customer comes back in `auth`. Every attempt waits about half a second. After too many failed attempts the customer is locked out for 10 minutes (`401`).

## Parameters

- `account_id` (query): The account the customer belongs to. Required when you send no token. Not allowed with a token.
- `test` (query): `true` to sign in a test customer. Only when you send no token; with a token, its mode is used and sending `test` is a `400`.
- `user_ip_address` (query): The shopper's IP address, when your server calls with a secret token on the shopper's behalf. Comecero uses it for fraud checks and to find the shopper's country. Only read for a secret token: for every other token the address the request comes from is used. A value that is not a valid IPv4 or IPv6 address is ignored.
- `expand` (query): Comma-separated child objects to return in full instead of as a URL, for example `customer,payments`. Use dot notation for nested objects (`items.product`), up to four levels deep. A single object takes up to 12 paths; a list takes up to 2, applied to every item. Extra paths are dropped without an error. See [Expanding objects](https://docs.comecero.com/docs/basic-concepts/expanding-objects).
- `show` (query): Comma-separated fields to return; all others are left out. Use dot notation for child fields (`customer.email`). You cannot send `show` and `hide` together (`400`). See [Customizing output](https://docs.comecero.com/docs/basic-concepts/customizing-output).
- `hide` (query): Comma-separated fields to leave out of the response. Use dot notation for child fields (`customer.email`). You cannot send `show` and `hide` together (`400`). See [Customizing output](https://docs.comecero.com/docs/basic-concepts/customizing-output).
- `formatted` (query): When `true`, the object also has a `formatted` child with amounts and dates as display text in the shopper's language and currency (for example `$19.99` or `November 7, 2026`). The default is `false`. See [Localized formatting](https://docs.comecero.com/docs/basic-concepts/localized-formatting).

Request body: the `customer_login_request` schema.

Responses: 200, 400, 401, 403.

Full schemas: operation `login_customer` in /openapi.json.