POST

Authorizations

apikey
string
header
required

Your publishable (pb_pk_…) or secret (pb_sk_…) key.

Body

application/json
grant_type
enum<string>
default:password

password signs in with email and password, refresh_token renews a session, mfa finishes a second-factor challenge.

Available options:
password,
refresh_token,
mfa,
client_credentials
email
string | null

For password: the account email.

password
string | null

For password: the account password.

refresh_token
string | null

For refresh_token: the token from the last response.

mfa_token
string | null

For mfa: the token returned by the first step.

remember_device
boolean
default:false

Skip the second factor on this device for a while.

code
string | null

For mfa: the code from the authenticator or email.

client_id
string | null
Maximum string length: 64
client_secret
string | null
Maximum string length: 200
scope
string | null
Maximum string length: 2000
org
string | null

Sign in to this organization (its slug), when the user belongs to several.

Maximum string length: 63

Response

Success.

access_token
string
required

Signed JWT to send as Authorization: Bearer <token>.

refresh_token
string
required

Single-use token that exchanges for a new access token.

token_type
string
required

Always bearer.

expires_in
integer
required

Seconds until the access token expires.

expires_at
integer
required

When it stops being valid.

session_id
string
required
org
null
required
org_role
null
required
user
object
required
device
object
required