Sign in, refresh, or complete MFA
Sign in, refresh, or complete MFA. End-user authentication. Send the API key in the apikey header; user endpoints also need Authorization: Bearer.
Authorizations
Your publishable (pb_pk_…) or secret (pb_sk_…) key.
Body
password signs in with email and password, refresh_token renews a session, mfa finishes a second-factor challenge.
password, refresh_token, mfa, client_credentials For password: the account email.
For password: the account password.
For refresh_token: the token from the last response.
For mfa: the token returned by the first step.
Skip the second factor on this device for a while.
For mfa: the code from the authenticator or email.
642002000Sign in to this organization (its slug), when the user belongs to several.
63Response
Success.
Signed JWT to send as Authorization: Bearer <token>.
Single-use token that exchanges for a new access token.
Always bearer.
Seconds until the access token expires.
When it stops being valid.