Auth

Exchange an emailed code for a token pair

post/auth/tokens

Request

  • Base URL: https://bodylab.lol/api/v1
  • URL: https://bodylab.lol/api/v1/auth/tokens
  • Auth: none required

Headers

X-Client-Platformstring

The native client's platform, e.g. ios. Server-side and non-native callers omit it.

X-Client-Versionstring

The native client's own semver version. With X-Client-Platform, a version below that platform's minimum is refused with CLIENT_UPGRADE_REQUIRED (426).

Request body

emailstring required
codestring required
deviceLabelstring

Shown when managing signed-in devices.

platformstring

The kind of client signing in, as the client declares it — never sniffed from a user agent. Known values: ios, android, web. Treat unknown values as "other".

Response

OK

accessTokenstring required

Short-lived; send as Authorization: Bearer <token>.

refreshTokenstring required

Rotates on every refresh; reusing an old one revokes the chain.

expiresIninteger required

Seconds until the access token expires.

userIdstring required

Opaque identifier.

Changes

No recorded changes to this operation across all 1 revision of this API.