Authentication
Get ID Token
POST
Get ID Token
Authenticates a user with their email and password and returns a JWT
Without a valid token, protected routes will respond with a 401 Unauthorized error. This token expires after 1 hour after which you must call
Retry including the six-digit code from your authenticator app:
This is the flow to use for servers, cron jobs and CI. Two-factor authentication does not apply
here, because the second factor was already satisfied when the refresh token was issued.
Set it up once:
idToken.
This idToken must be included in the Authorization header when calling protected APIs.
🛡️ Authorization Header Format:
/get_id_token again to obtain a new one.
🔐 Accounts with two-factor authentication
If the account has 2FA enabled, email and password alone are not enough — the request responds401 with:
Staying signed in without a password
Every successful sign-in also returns arefreshToken. Send it back on its own to get a fresh
idToken — no password, and no two-factor code:
- Sign in by hand with
user_email_id,passwordand — if 2FA is on — atotp_code. - Store the returned
refreshTokenwherever you keep secrets. - From then on, call this endpoint with
refresh_tokenwhenever theidTokenexpires (hourly).
Body
application/json
Send either user_email_id + password (plus totp_code if two-factor is enabled), or refresh_token on its own to renew without a password.
Required unless refresh_token is supplied.
Example:
Required unless refresh_token is supplied.
Example:
"your-password"
Renew an ID token without a password or two-factor code. Use this for unattended integrations. Cannot be combined with password.
Example:
"eyJjdHkiOiJKV1QiLCJlbmMiOiJBMjU2R0NNIi..."
Six-digit code from your authenticator app. Required only if the account has two-factor authentication enabled.
Pattern:
^[0-9]{6}$Example:
"123456"
Response
200 - application/json
Successful authentication and token retrieval.
Get ID Token