Chelabase
Login apiLogin

Mint Member Token

POST
/auth/v1/token

Mints a member access token from the HttpOnly session cookie, after checking that the identity session is live and younger than 30 days and that the membership is active. Takes no body. Studio must send Origin and X-Chelabase-Studio: 1. Never cached.

Query Parameters

tenant?string

The tenant's id. Needed to sign in to one of several; /auth/v1/token refuses any but the session's. Never trusted: it is checked against the memberships.

Response Body

application/json

application/json

application/json

application/json

application/json

curl -X POST "https://example.com/auth/v1/token"
{  "access_token": "string",  "expires_in": 0}

Get Studio Config GET

Studio's runtime config: the API URL and Studio's host. Public; cacheable for 60 s.

Verify Email POST

Checks the emailed code. Reads the HttpOnly step cookie and clears it once the email is verified. An open sign-up joins its tenant now, as a person waiting for approval. The answer is a sign-in's: `studio` sets the HttpOnly session cookie, `pending` sets none. If sign-up closed since the account was made, the answer is `sign_up_closed` and the account is deleted. A retry after a failure past the code finishes with the same code.