POST
Error

Authorizations

apikey
string
header
required

Your publishable (pb_pk_…) or secret (pb_sk_…) key.

Authorization
string
header
required

The signed-in person's access token.

Body

application/json
mfa_token
string
required

The token returned by the setup start call.

Required string length: 1 - 2048
code
string
required

The first code from the authenticator, to prove it works.

Required string length: 6 - 32
org
string | null

Organization to sign in to.

Maximum string length: 63

Response

Success.

access_token
string
required

Signed JWT to send as Authorization: Bearer <token>.

refresh_token
string
required

Single-use token that exchanges for a new access token.

token_type
string
required

Always bearer.

expires_in
integer
required

Seconds until the access token expires.

expires_at
integer
required

When it stops being valid.

session_id
string
required
org
null
required
org_role
null
required
user
object
required
recovery_codes
string[]
required