API referenceSign-in and account
Sign in with email and password
POST
Checks the email and password. Without 2FA it starts a session (HttpOnly cookie). With 2FA it returns status secondFactor and a ticket for auth.verifySecondFactor.
Needs no sign-in. Not available to MCP clients or the assistant.
application/json- body
email*stringFormat
emailLength
length <= 254password*stringLength
1 <= length <= 1024Success.
application/json- response
status*string|stringviewer*challenge?curl -X POST 'https://example.com/api/v1/auth.login' \ -H 'Content-Type: application/json' \ -d '{ "email": "[email protected]", "password": "string"}'Example Response
{ "status": "signedIn", "viewer": { "id": "string", "email": "[email protected]", "name": "string", "role": "owner" }, "challenge": { "ticket": "string", "methods": [ "totp" ], "expiresAt": "2019-08-24T14:15:22Z" }}List your sessions GET
Lists the signed-in person's browser sessions, newest activity first, marking the current one. Any signed-in caller. Not available to MCP clients or the assistant.
Sign out POST
Ends the current session and clears its cookie. API keys are not affected. Any signed-in caller. Not available to MCP clients or the assistant.