curl -sS -X POST 'https://matrix.example.com/_matrix/client/v3/login' -d '{"type":"m.login.password","identifier":{"type":"m.id.user","user":"alice"},"password":"secret"}'

Authenticates with username and password and returns an access_token plus device_id to use in later requests. This is how scripts and bots authenticate without a client app. Note the token lives in the shell history, so prefer an existing token or a password prompt in production. The admin login-as-user endpoint mints tokens for other accounts.