API reference

Base path: /api

Most routes need the project-id header. Authenticated routes also need Authorization: Bearer <access_token>.

Endpoint list

Method	Path	Auth	Description
POST	`/auth/signup`	—	Register
POST	`/auth/login`	—	Password sign-in
POST	`/auth/refresh`	refresh token body	Rotate session
POST	`/auth/logout`	access token	Revoke current session
POST	`/auth/logout-all`	access token	Revoke all sessions
GET	`/auth/me`	access token	Current user
POST	`/auth/change-password`	access token	Change password
POST	`/auth/verify-email/resend`	—	Resend verification
POST	`/auth/verify-email/confirm`	—	Confirm with token
GET	`/auth/api-keys`	access token	List user API keys
POST	`/auth/api-keys`	access token	Create `uak_…` key
POST	`/auth/api-keys/{keyId}/revoke`	access token	Revoke key
POST	`/auth/api-keys/introspect`	project token + `introspect`	Validate a `uak_…` key

Common headers

Name	Required	Description
`Accept`	Yes	Use `application/json`
`project-id`	Yes	Project UUID
`Authorization`	For protected routes	`Bearer ACCESS_TOKEN`

Token response

Successful signup (when tokens are issued), login, and refresh return:

{
  "access_token": "eyJ...",
  "token_type": "Bearer",
  "expires_at": "2026-08-04T12:15:00.000000Z",
  "refresh_token": "...",
  "refresh_token_expires_at": "2026-09-03T12:00:00.000000Z",
  "user": {
    "id": 1,
    "uuid": "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx",
    "email": "user@example.com",
    "display_name": "Ada",
    "email_verified_at": null,
    "metadata": {}
  }
}

[POST] /auth/signup

Body

Name	Type	Required	Description
`email`	string	Yes	User email
`password`	string	Yes	Password
`display_name`	string	No	Display name

Responses

201 — tokens issued
202 — email verification required

{
  "message": "Email verification required.",
  "code": "email_verification_required",
  "verification_required": true,
  "user": {
    "id": 1,
    "uuid": "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx",
    "email": "user@example.com",
    "display_name": "Ada",
    "email_verified_at": null,
    "metadata": {}
  }
}

Example

curl -X POST https://your-domain.com/api/auth/signup \
  -H "Accept: application/json" \
  -H "Content-Type: application/json" \
  -H "project-id: YOUR_PROJECT_UUID" \
  -d '{"email":"user@example.com","password":"secret-password","display_name":"Ada"}'

[POST] /auth/login

Body

Name	Type	Required	Description
`email`	string	Yes	User email
`password`	string	Yes	Password

Responses

200 — token response
401 — invalid credentials
403 — email verification required
429 — lockout after failed attempts (retry_after seconds)

Example

curl -X POST https://your-domain.com/api/auth/login \
  -H "Accept: application/json" \
  -H "Content-Type: application/json" \
  -H "project-id: YOUR_PROJECT_UUID" \
  -d '{"email":"user@example.com","password":"secret-password"}'

Refresh

[POST] /auth/refresh

Body

Name	Type	Required	Description
`refresh_token`	string	Yes	Current refresh token

Responses

200 — new token response
401 — invalid refresh token
403 — email verification required

Logout

[POST] /auth/logout

Requires access token. Revokes the current session.

Logout all

[POST] /auth/logout-all

Requires access token. Revokes every session for the user.

Me

[GET] /auth/me

Requires access token.

{
  "user": {
    "id": 1,
    "uuid": "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx",
    "email": "user@example.com",
    "display_name": "Ada",
    "email_verified_at": "2026-08-04T12:00:00.000000Z",
    "metadata": {}
  }
}

Change password

[POST] /auth/change-password

Body

Name	Type	Required	Description
`current_password`	string	Yes	Current password
`new_password`	string	Yes	New password (min 8)

Email verification

See Email verification for resend and confirm details.

User API keys

See User API keys for create, list, revoke, and introspect.

Webhooks

Authentication can emit events such as:

auth.signup.success
auth.login.success
auth.logout.success
auth.logout_all.success
auth.email_verification.verified

Configure them under Webhooks.

Notes

Responses do not include an abilities array.
Social id_token exchange is not available in the current API.
For CMS writes, use a BFF and a project API token.

SDK
Concepts

API reference

API reference

Endpoint list

Common headers

Token response

Signup

Body

Responses

Example

Login

Body

Responses

Example

Refresh

Body

Responses

Logout

Logout all

Me

Change password

Body

Email verification

User API keys

Webhooks

Notes

Next

Search documentation