API

Accounts API

On this page

These routes use the browser session. Validation failures redirect back with errors.

Auth: guest. A signed-in user is redirected to app home, or to create a workspace when they have none.
Name: login
Request: none.
Response: the Login page. Stage is register when registration_email is in the session, sent when a magic link was just issued, otherwise login.
Errors: none.

POST /auth/email

Auth: guest.
Name: auth.email.send
Request: email, required, RFC email, max 255 characters. Stored lowercased and trimmed.
Response: redirect back. A known user receives a magic link and the session stores auth_email_sent. An unknown email is stored as registration_email and no mail is sent yet.
Errors: validation error on email. Throttled at 5 attempts per 15 minutes for the same IP and email.

Auth: guest. The URL is a temporary signed route that expires in 15 minutes.
Name: auth.email.consume
Request: loginToken id and the plain token.
Response: redirect to create a workspace when the user has none, otherwise to the intended app home. A pending workspace invite is accepted first. The session is regenerated and the login is remembered. The first successful sign-in also sends the developer welcome. A later sign-in does not.
Errors: redirect to login when the link is already consumed, expired, or the token hash does not match, or when the account no longer exists. An invalid signature is rejected by the signed middleware.

Auth: guest, with registration_email in the session.
Name: auth.register
Request: first_name and last_name (required, max 80), app_count (Not launched yet, 1, 2–3, 4–10, 11+), stacks (one or more of Expo, React Native, Flutter, Swift, Kotlin, Web, Other), role (Engineer, Developer, Designer, Marketer, developer, Product Manager, Other).
Response: redirect back after the user is created and a magic link is sent. the developer welcome is not sent yet. If the email already exists, no second user is created and a link is sent instead.
Errors: 403 when the session has no registration email. Validation errors redirect back.

Auth: guest.
Name: auth.restart
Request: none.
Response: redirect to login after clearing auth_email_sent and registration_email.
Errors: none.

Auth: guest.
Name: auth.social.callback
Request: provider callback parameters.
Response: signed-in redirect to create a workspace, or to the intended app home. A pending workspace invite is accepted first. A new social account is linked to the matching verified email, or a user is created. Creating the user also sends the developer welcome. Linking an existing user does not.
Errors: 404 for an unknown provider. Redirect to login when the provider call fails or the provider does not return a verified email.

Auth: signed-in session.
Name: account.edit
Request: none.
Response: the account page for the current user, inside the current workspace when they have one. Includes the sign-in providers and the latest sign-ins.
Errors: guests are redirected to login.

Auth: signed-in session.
Name: account.email
Request: email (required, unique, max 255).
Response: redirect back. A confirmation link is emailed to the new address. The account email does not change yet. The same address as the current one sends nothing.
Errors: validation when the address is already used. Guests are redirected to login.

Auth: signed URL. Guest or the same signed-in user.
Name: account.email.confirm
Request: email query covered by the signature. The link expires in 15 minutes.
Response: the account email becomes that address. A signed-in user returns to the account page. A guest is sent to login.
Errors: 403 when the signature is invalid, the address is not an email, or a different user is signed in. Redirect with an error when another account already uses the address.