Chelabase
Login apiLogin

Sign In

POST
/auth/v1/sign-in

Signs in with email and password. studio sets the HttpOnly session cookie, which seals the identity session and the tenant. verify sets the HttpOnly step cookie that the code step reads. pending sets no cookie: an admin hasn't approved this person yet. A wrong password, an unknown email and no active membership answer alike.

Query Parameters

tenant?string

The tenant's id. Needed to sign in to one of several; /auth/v1/token refuses any but the session's. Never trusted: it is checked against the memberships.

Request Body

application/json

TypeScript Definitions

Use the request body type in TypeScript.

email*string
password*string

Response Body

application/json

application/json

application/json

application/json

application/json

application/json

application/json

application/json

application/json

curl -X POST "https://example.com/auth/v1/sign-in" \  -H "Content-Type: application/json" \  -d '{    "email": "string",    "password": "string"  }'
{  "next": "studio"}

Resend Code POST

Sends the verification code again. Reads the HttpOnly step cookie. Always answers the same, whether or not a code was sent; at most 5 codes go out per person an hour.

Sign Up POST

Creates an account: the fresh-install admin with the setup code, otherwise a person waiting for an admin's approval. With email verification off it signs them in, so the answer is `studio` (the session cookie) or `pending` (no cookie). With it on, `verify` and the HttpOnly step cookie that the code step reads.