POST

Authorizations

apikey
string
header
required

Your publishable (pb_pk_…) or secret (pb_sk_…) key.

Body

application/json
email
string
required

The new user's email address.

Maximum string length: 255
password
string
required

The password, checked against the environment's password policy.

Required string length: 1 - 1024
username
string | null

A unique handle, if usernames are enabled.

Maximum string length: 150
name
string
default:""

Display name.

Maximum string length: 200
data
Data · object

Initial user_metadata

accepted_terms
boolean
default:false

Required when the environment lists required legal documents

redirect_to
string | null

Where the link in the email should send the person afterwards. Must be an allowed redirect URL for this environment.

Response

Created. The body is the new object.

access_token
string
required

Signed JWT to send as Authorization: Bearer <token>.

refresh_token
string
required

Single-use token that exchanges for a new access token.

token_type
string
required

Always bearer.

expires_in
integer
required

Seconds until the access token expires.

expires_at
integer
required

When it stops being valid.

session_id
string
required
org
null
required
org_role
null
required
user
object
required
device
object
required
verification_required
boolean
required