# Login

Initiates the authentication flow with SPID, CIE, or EIDAS by redirecting the user to the identity provider.

Deprecated endpoint
The previous endpoint `/{environment_name}/login_file.php` is deprecated. Use the endpoints below instead.

For the full technical reference, see the [OpenAPI specification](/products/esp/openapi/login).

#### Endpoint

| Method | URL | Identity scheme |
|  --- | --- | --- |
| `GET` | `/{environment_name}/spidlogin` | SPID / EIDAS |
| `GET` | `/{environment_name}/cielogin` | CIE |
| `GET` | `/{environment_name}/cnslogin` | CNS |


#### Path parameters

| Name | Type | Required | Description |
|  --- | --- | --- | --- |
| `environment_name` | string | Yes | The environment path provided by Namirial during the assessment phase (e.g. `myintegration`) |


#### Query parameters

| Name | Type | Required | Description |
|  --- | --- | --- | --- |
| `authnKey` | string | Yes | The session key obtained from the [Get key](/products/esp/enterprise-documentation/developer-documentation/integration-guide/getkey) endpoint |
| `final` | string | Yes | Redirect URL called at the end of the authentication process (defined during the assessment phase) |
| `reference` | string | No | Alphanumeric string (max 50 characters) used to tag the authentication request. Returned in the JWT |


#### Request example

**SPID / EIDAS**


```
GET /{environment_name}/spidlogin
  ?authnKey=<authnKey>
  &final=https://your-app.example.com/callback
```

**CIE**


```
GET /{environment_name}/cielogin
  ?authnKey=<authnKey>
  &final=https://your-app.example.com/callback
```

**CNS**


```
GET /{environment_name}/cnslogin
  ?authnKey=<authnKey>
  &final=https://your-app.example.com/callback
```

The constructed URL must be opened in a browser. The user will be presented with the identity provider login screen.

#### Response examples

**Redirect — Authentication successful**

The user is redirected to the `final` URL with `sessionid` and `sessionkey` query parameters appended. Call the [Get user token](/products/esp/enterprise-documentation/developer-documentation/integration-guide/token) endpoint to retrieve the JWT.

`cnslogin` returns a JWT directly as a `token` query parameter in the redirect, instead of `sessionid` and `sessionkey`. The [Get user token](/products/esp/enterprise-documentation/developer-documentation/integration-guide/token) step is not required for CNS authentication.