Sessions

Sign in with email and password to get an access token and a refresh token, renew them, and check which sign-in methods the server offers. Scripts and long-running integrations should use an API token instead of signing in with a password; see API Tokens.

📄️ Sign in and get tokens

Signs in with email and password and returns the access token and refresh token in the response body instead of cookies. Send the access token as `Authorization: Bearer <token>` and renew it with `POST /api/v1/auth/api-sessions/current/refresh` before it expires. For scripts and integrations, a long-lived API token is usually simpler.

📄️ Refresh tokens

Exchanges a refresh token obtained from `POST /api/v1/auth/api-sessions` for a new access token and refresh token.

📄️ Sign in with email and password

Signs in a browser user. On success the session is stored in secure HTTP-only cookies (access token, refresh token, and expiration time) and the response describes the signed-in user. Fails when password login is disabled for this user. API clients that cannot use cookies should call `POST /api/v1/auth/api-sessions` or, better, use an API token.

📄️ Sign out

Ends the browser session by clearing the session cookies. Access tokens already issued to API clients stay valid until they expire.

📄️ Get sign-in options

Returns which sign-in and registration methods are enabled on this server (password, OIDC), whether demo mode is on, and the available demo personas. It does not say who is signed in; use `GET /api/v1/users/me` for that.

📄️ Refresh the browser session

Renews the browser session using the refresh-token cookie and sets new session cookies. Used by the web app; API clients should use `POST /api/v1/auth/api-sessions/current/refresh`.