post
https://us-clover.passportalmsp.com/api/v2/auth/user_token
Exchanges an email + password + organization key for an MFA challenge or, when MFA is disabled, for an access token and refresh token directly. The user must exist in the organization, must not be locked out, and the requested scope must be permitted for user tokens. When MFA is enabled, use the returned mfa_key with the '/api/v2/auth/mfa' endpoint to complete authentication.