Authentication

Signing people in and keeping them signed in.

These take a publishable key. They are designed to be called from a browser.

Sign up

{ "email": "ada@example.com", "password": "correct horse battery staple" }

Returns the user and, unless your environment requires email confirmation first, a session.

Sign in

{ "email": "ada@example.com", "password": "…" }

email accepts an address or a username. Failures are uniform: a wrong password and an unknown account return the same error, so the endpoint cannot be used to enumerate your users.

{
  "user": { "id": "user_…", "email": "ada@example.com", "…": "…" },
  "session": {
    "accessToken": "eyJ…",
    "refreshToken": "rt_…",
    "expiresIn": 900,
    "tokenType": "Bearer",
    "organization": null
  }
}

Passwordless

{ "email": "ada@example.com" }

Both answer the same way for any address:

{ "sent": true, "message": "If that address has an account, we have sent it a message." }

Codes are redeemed with:

{ "email": "ada@example.com", "code": "418293" }

Magic links are redeemed by the hosted page, which returns a one-time code your app exchanges.

Refresh

{ "refreshToken": "rt_…" }

Switch organization

{ "refreshToken": "rt_…", "organizationId": "org_…" }

Pass null to return to personal scope. Returns a fresh user and session, because the organization is a claim inside the tokens.

Sign out

{ "refreshToken": "rt_…" }

Environment

Which environment your key resolves to, which sign-in methods are enabled, your limits, and your branding. The SDK calls this once at start-up.

Updated at, Friday, August 28, 2026