Authentication API

Manage accounts and sessions.

Signup is disabled

POST /api/v1/auth/signup

This compatibility route no longer creates accounts or organizations. Interested clients contact tp.babparn@gmail.com; the founder provisions each workspace through an owner-only Google-authenticated form.

HTTP 403 Forbidden

{"error":"Self-service signup is disabled. Contact tp.babparn@gmail.com for beta access."}

Login

POST /api/v1/auth/login

Rate Limit

5 requests per IP per 15 minutes.

Request Body

{
  "email": "you@example.com",
  "password": "your-secure-password"
}

Response

HTTP 200 OK

{
  "user": {
    "id": "a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6",
    "email": "you@example.com",
    "name": "Your Name",
    "org_id": "e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0",
    "role": "admin"
  },
  "session_token": "abc123def456..."
}

Error Responses

{"error": "email and password are required"}

{"error": "unauthorized"}

Logout

POST /api/v1/auth/logout

Destroys the current session. Requires X-Session-Token header.

Response

{"ok": true}

Logout All

POST /api/v1/auth/logout-all

Revokes all sessions for the authenticated user. Requires authentication (API key or session token).

Response

{
  "ok": true,
  "sessions_revoked": true
}

Get Current User

GET /api/v1/auth/me

Returns information about the authenticated identity.

Response

With session token (full user info):

{
  "user": {
    "id": "a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6",
    "email": "you@example.com",
    "name": "Your Name",
    "org_id": "e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0",
    "role": "admin"
  }
}

With API key (org info only):

{
  "user": {
    "org_id": "e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0"
  }
}

Session Properties

Property	Value
Duration	7 days
Max per user	5 (oldest evicted on new login)
Storage	Server-side
Revocable	Yes (immediate)