Skip to content

Auth

All endpoints live under /auth. Request + response bodies are JSON.

Endpoints

POST /auth/signup: create a new account.
POST /auth/login: exchange credentials for tokens (or an MFA challenge).
POST /auth/mfa/verify: redeem an MFA challenge for tokens.
POST /auth/mfa/enroll: start TOTP enrollment.
POST /auth/mfa/activate: confirm TOTP enrollment.
GET /auth/mfa/authenticators: list the authenticator apps on the account.
DELETE /auth/mfa/authenticators/{id}: remove one authenticator app.
POST /auth/refresh: rotate a refresh token into a new pair.
POST /auth/logout: revoke a refresh token server-side.
GET /auth/me: whoami: full profile, memberships, MFA state.

API keys

POST /auth/api-keys: mint a new key. Returns the secret once.
GET /auth/api-keys: list keys for the current org.
DELETE /auth/api-keys/{id}: revoke a key.

Types

`TokenPair`

Returned by login (when MFA is off), mfa/verify, and refresh.

Field	Type	Notes
`access_token`	string	JWT.
`refresh_token`	string
`access_expires_at`	string	ISO-8601 UTC.
`refresh_expires_at`	string	ISO-8601 UTC.

`LoginResponse`

Discriminated union on status returned by login.

`status`	Body
`mfa_required`	`{ status: "mfa_required", challenge_id: string }`. `challenge_id` is `mfa_<opaque>`, single-use, ~5 min TTL. Default: accounts have MFA on by default.
`tokens`	All `TokenPair` fields above, alongside `status: "tokens"`. Returned only when the account has MFA disabled.