> ## Documentation Index
> Fetch the complete documentation index at: https://docs.purplelabelmd.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Begin Universal Login and redirect to the login page

> Starts the hosted Universal Login flow for your patient and redirects to the login page (passwordless email code, Google, or Apple — never a patient password). Call this to sign a patient in; the login is scoped to the brand you pass. On return, the callback endpoint completes the sign-in and starts the session.



## OpenAPI

````yaml /openapi/public-openapi.json get /v1/auth/login
openapi: 3.1.0
info:
  title: Purple API
  version: 0.0.0
servers:
  - url: https://api.dev.purplelabelmd.com
security: []
tags:
  - description: Sign a patient in and out and manage the browser session.
    name: Sessions & authentication
  - description: Run the server-driven intake questionnaire question by question.
    name: Intake
  - description: Address autocomplete for the intake flow.
    name: Addresses
  - description: Read the public status of a patient's enrollment.
    name: Enrollment
  - description: Track a client's onboarding progress.
    name: Onboarding
  - description: Read back the platform configuration stored for your brand.
    name: Brand configuration
  - description: Enable offerings for your brand and set their display copy.
    name: Offering configuration
  - description: Start and track payments for an order.
    name: Payments
  - description: Subscribe to platform events and manage delivery endpoints.
    name: Webhooks
paths:
  /v1/auth/login:
    get:
      tags:
        - Sessions & authentication
      summary: Begin Universal Login and redirect to the login page
      description: >-
        Starts the hosted Universal Login flow for your patient and redirects to
        the login page (passwordless email code, Google, or Apple — never a
        patient password). Call this to sign a patient in; the login is scoped
        to the brand you pass. On return, the callback endpoint completes the
        sign-in and starts the session.
      operationId: authLogin
      parameters:
        - description: the brand (brd_...) this login is scoped to
          in: query
          name: brand
          required: true
          schema:
            pattern: ^brd_[A-Za-z0-9][A-Za-z0-9_-]*$
            type: string
        - description: optional connection hint (never a password connection)
          in: query
          name: connection
          required: false
          schema:
            enum:
              - email
              - google-oauth2
              - apple
            type: string
        - description: >-
            post-login return URL; brand allowlist only (open redirect barred,
            fail-closed)
          in: query
          name: returnTo
          required: false
          schema:
            type: string
        - $ref: '#/components/parameters/CorrelationIdHeader'
      responses:
        '302':
          description: >-
            redirect to the hosted Universal Login page; sets the transaction
            cookie
          headers:
            Location:
              schema:
                type: string
            Set-Cookie:
              schema:
                type: string
        '400':
          description: brand query parameter absent or malformed
        '429':
          $ref: '#/components/responses/EdgeRateLimited'
      security: []
components:
  parameters:
    CorrelationIdHeader:
      description: >-
        An optional id you send to tie this request to your own logs. Send one
        and it is echoed back unchanged; omit it and one is assigned for you.
        Either way the id is returned in the X-Correlation-Id response header on
        every response, including errors, so you can match a response to the
        request that produced it.
      in: header
      name: X-Correlation-Id
      required: false
      schema:
        maxLength: 128
        pattern: ^[A-Za-z0-9][A-Za-z0-9._:-]*$
        type: string
  responses:
    EdgeRateLimited:
      content:
        application/problem+json:
          schema:
            $ref: '#/components/schemas/EdgeProblem'
      description: >-
        Too many requests. You have exceeded the request rate allowed for this
        endpoint. Wait the number of seconds given in the Retry-After response
        header, then retry the request.
      headers:
        Retry-After:
          description: Seconds to wait before you retry.
          schema:
            type: integer
        X-Correlation-Id:
          description: The correlation id for this request, echoed back.
          schema:
            type: string
  schemas:
    EdgeProblem:
      description: RFC 7807 problem+json error body.
      properties:
        detail:
          type: string
        status:
          type: integer
        title:
          type: string
        type:
          format: uri-reference
          type: string
      required:
        - type
        - title
        - status
      type: object

````