Skip to main content
POST
Get ID Token
Authenticates a user with their email and password and returns a JWT idToken. This idToken must be included in the Authorization header when calling protected APIs.

🛡️ Authorization Header Format:

Without a valid token, protected routes will respond with a 401 Unauthorized error. This token expires after 1 hour after which you must call /get_id_token again to obtain a new one.

🔐 Accounts with two-factor authentication

If the account has 2FA enabled, email and password alone are not enough — the request responds 401 with:
Retry including the six-digit code from your authenticator app:
TOTP codes are single-use and rotate every 30 seconds, so a server cannot generate one. Do not attempt to automate this step — use the refresh token flow below instead.

Staying signed in without a password

Every successful sign-in also returns a refreshToken. Send it back on its own to get a fresh idToken — no password, and no two-factor code:
This is the flow to use for servers, cron jobs and CI. Two-factor authentication does not apply here, because the second factor was already satisfied when the refresh token was issued. Set it up once:
  1. Sign in by hand with user_email_id, password and — if 2FA is on — a totp_code.
  2. Store the returned refreshToken wherever you keep secrets.
  3. From then on, call this endpoint with refresh_token whenever the idToken expires (hourly).
A refresh token is valid for 30 days from the moment it is issued, and refreshing does not extend it. refreshTokenExpiresAt in the response tells you exactly when it dies — alert on it, and repeat step 1 before that date. After it expires, requests fail with 401 until you sign in with your password again.
Treat a refresh token like a password: store it encrypted, never commit it. To revoke one, change the account password or sign out everywhere, which invalidates all outstanding refresh tokens.

Body

application/json

Send either user_email_id + password (plus totp_code if two-factor is enabled), or refresh_token on its own to renew without a password.

user_email_id
string

Required unless refresh_token is supplied.

password
string

Required unless refresh_token is supplied.

Example:

"your-password"

refresh_token
string

Renew an ID token without a password or two-factor code. Use this for unattended integrations. Cannot be combined with password.

Example:

"eyJjdHkiOiJKV1QiLCJlbmMiOiJBMjU2R0NNIi..."

totp_code
string

Six-digit code from your authenticator app. Required only if the account has two-factor authentication enabled.

Pattern: ^[0-9]{6}$
Example:

"123456"

Response

200 - application/json

Successful authentication and token retrieval.

data
object