Log in

Email and password

Same credentials as the rest of Kumir. Demo: the seeded buyer

Redirects stay on Kumir

redirectFromSearch only allows same-origin paths. Default return is home.

Too many attempts wait

429 / login-hint shows Wait a few minutes. The password is never guessed for you.

Forgot password is shared

/forgot is the same reset flow as business login. No invented Resend key.

Not Kumir for Business login

Brands use /business/login. This chrome stays on personal Kumir.

Not Create an account

No account? /signup. Login does not create a row.

Not talent enroll

/enroll is supply. Login does not open a studio queue.

SSO stays hidden until configured

Google/Apple buttons stay off until AUTH_GOOGLE_* / AUTH_APPLE_* exist. Never fake SSO.

Impersonation stays web-only

CS impersonation is a web admin tool. iOS and Android never impersonate.

/login is reserved, not a username

Nav Log in goes here. That path is reserved, like /signup and /forgot.

The form never fakes a fan session

Sign-in verifies the password. It does not mint a home session.

Native uses the same password

iOS LoginForm and Android splash call POST /api/v1/auth/login. Same password, HS256 session.