Log in
Getting started
Authentication
Log in and authorize requests
POST
Log in
To use any authenticated route you need an auth token. Tokens are obtained by logging in and are valid for 30 days, after which a fresh login is required.
See
If no token is provided — or the token is unknown / expired — the server responds with
Log in
POST /user/login
Request
string
required
Account username (or email).
string
required
Account password.
Response
The token is returned both asdata.user.auth and as a signed auth cookie (Set-Cookie). For most server-side integrations you’ll want to capture data.user.auth and discard the cookie.
User in the OpenAPI schema for every field.
Error responses
Authorizing requests
Pass the token fromdata.user.auth on every subsequent request. Three header / payload formats are accepted, in this order of preference:
- Body field (POST only)
401 InvalidCredentials.
Token rotation
Authenticated requests with tokens older than 30 days automatically rotate to a new token. When this happens, the new token is returned in theX-Auth-Token response header (and as an updated signed auth cookie). Long-lived integrations should watch for this header and persist the new value.
Logging out
POST /user/logout invalidates the current token. Subsequent requests with that token return 401.