API Reference Auth & Account

Auth & Account Endpoints

12 endpoints covering the full account lifecycle: registration, login, email verification, Google sign-in, password recovery, API key management, account status checks, and Google unlink.

Bearer JWT for auth flows Authorization: Bearer <token>
JWT set Key set No credentials set

Lifecycle Overview

Session first, key second

Interactive login returns a JWT session only. API keys are created explicitly via POST /v1/auth/api-keys and are never auto-generated on your behalf.

Account parity

GET /v1/me/account and POST /v1/me/google/unlink give the CLI stable visibility into sign-in methods, plan source, and linked-auth state.

Auth & Account Inventory

12
MethodPathDescription
POST/v1/auth/registerCreate a new account.
POST/v1/auth/loginSign in with username or email and receive a JWT.
POST/v1/auth/verify-emailVerify email with a six-digit code.
POST/v1/auth/resend-verificationRequest a fresh verification code.
POST/v1/auth/googleSign in or sign up with a Google credential.
POST/v1/auth/forgot-passwordStart password recovery without leaking account existence.
POST/v1/auth/reset-passwordReset a password with a verified recovery token.
POST/v1/auth/api-keysCreate an API key.
GET/v1/auth/api-keysList API keys for the authenticated user.
DELETE/v1/auth/api-keys/{key_id}Revoke one API key.
GET/v1/me/accountReturn account summary, plan source, and sign-in methods.
POST/v1/me/google/unlinkUnlink Google when password sign-in is already available.

Authenticate and return a JWT bearer token.

Request Body

FieldTypeDescription
username string Username or email*
password string Account password*

Response

FieldTypeDescription
access_token string JWT access token*
token_type string Always bearer* 

                    
                

            

            

                
                
Request

                
{
  "username": "hershel",
  "password": "secureP@ss123"
}

                
                
Response 200 OK

                
{
  "access_token": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...",
  "token_type": "bearer"
}

            

            
        

    





    


            
            
            
            
        


        

                
Create a new API key. The raw key is shown only once.

                
                
                
Request Body

                




    
FieldTypeDescription

    
    
        

            name
            string
            
            Human-readable key label*
        

    
    





                
                
                
Response

                




    
FieldTypeDescription

    
    
        

            id
            uuid
            
            API key ID*
        

    
        

            raw_key
            string
            
            Full rst_ key shown once*
        

    
        

            prefix
            string
            
            Stored key prefix*
        

    
        

            created_at
            datetime
            
            Creation timestamp*
        

    
    





                
                
            

                
                

                    
                    Requires JWT token — set it in the auth bar above
                

                

                

                    
                    
                    

                        
                        
                        
                        
                    

                    

                    
                

                
            

                

                    

                    
                

            

        

    





    


            
            
            
            
        


        

                
Return CLI-safe account and auth state for the current owner.

                
                
                
                
Response

                




    
FieldTypeDescription

    
    
        

            username
            string
            
            Username*
        

    
        

            google_linked
            boolean
            
            Whether Google is currently linked*
        

    
        

            has_password
            boolean
            
            Whether password sign-in exists*
        

    
        

            can_unlink_google
            boolean
            
            Safe unlink eligibility*
        

    
        

            available_sign_in_methods
            array
            
            password and or google*
        

    
    





                
                
            

                
                

                    
                    Requires owner auth — set a JWT token or API key in the auth bar above