---
title: "Sign in with Google: the website trades the code Google gave it. Signs in to the account linked to that Google account, else links the account with the same email when it has no password (one with a password answers 409), else creates one (201) with no password. With `invitationToken` it also accepts that invitation: the Google account's email must be the invited address, a new account gets no organization of its own, and the session acts for the inviting organization. No credential; the website calls this from its servers"
method: POST
path: "/v1/auth/google"
---

# Sign in with Google: the website trades the code Google gave it. Signs in to the account linked to that Google account, else links the account with the same email when it has no password (one with a password answers 409), else creates one (201) with no password. With \`invitationToken\` it also accepts that invitation: the Google account's email must be the invited address, a new account gets no organization of its own, and the session acts for the inviting organization. No credential; the website calls this from its servers

`POST /v1/auth/google`

## Request

- Base URL: `https://api.evictionsapi.com`
- URL: `https://api.evictionsapi.com/v1/auth/google`
- Auth: none required

## Request body

- object
  - `code` string, required
  - `codeVerifier` string, required
  - `redirectUri` string, required
  - `invitationToken` string

## Response `200`

A new session, with the user and organization (201 when the account was just created). An `Idempotency-Key` header is ignored.

- object
  - `token` string, required: A session token (`ess_...`), shown here only. Send it as `Authorization: Bearer`.
  - `user` object, required
    - `id` string, required
    - `name` string, nullable, required
    - `email` string, required
    - `role` 'customer' | 'attorney' | 'platform_admin', required: The kind of account. The person's role in an organization is the top-level `role`.
    - `emailConfirmed` boolean, required: Whether the person confirmed this address (with the emailed link, or by signing in with Google). Nothing depends on it: an unconfirmed account works the same.
    - `hasPassword` boolean, required: Whether the account has a password (an account made with Google has none until one is set).
    - `googleLinked` boolean, required: Whether a Google account is linked, so the person can sign in with Google.
  - `organization` object, nullable, required: The organization this session acts for; null when the person belongs to none.
    - `id` string, required
    - `name` string, required
    - `verified` boolean, required
    - `kind` unknown, required
    - `contactEmail` string, nullable, required
    - `contactPhone` string, nullable, required
    - `contactAddress` string, nullable, required
    - `billingEmail` string, nullable, required
  - `role` unknown, required
  - `permissions` string[], required: What the person may change in that organization. Reading needs no permission. Empty without an organization.
  - `organizations` object[], required: Every organization the person belongs to, oldest membership first.
    - `id` string, required
    - `name` string, required
    - `kind` unknown, required
    - `role` 'owner' | 'member' | 'viewer' | 'custom', required
    - `caseEmails` 'all' | 'mine' | 'none', required: Which of the organization's case emails the person gets: all, only cases they opened, or none (`PATCH /v1/me/organizations/:id`).
  - `modes` object, required: The modes this server offers. `test` is always true.
    - `test` boolean, required
    - `live` boolean, required

## Other responses

- `400`: The request is invalid, `redirectUri` is not the website's Google callback, or Google did not accept the code (`invalid_google_code`).
- `403`: `google_account_not_allowed`: the account may not sign in with Google (a law-firm user, the operator, a platform address, or a user already linked to another Google account), or `account_disabled`: the account has been disabled. With `invitationToken`: `account_kind`, an attorney's or the operator's account cannot join an organization.
- `404`: `invitation_invalid`: `invitationToken` is unknown, already used, revoked or expired. Google was not asked.
- `409`: `google_use_password`: an account with this email already exists and has a password. Sign in with the email and password; it is not linked to the Google account. With `invitationToken`: `invitation_email_mismatch`, the Google account's email is not the invited address; `already_member`; `member_limit`, the organization already has 50 people. Nothing was created or linked.
- `413`: The request body is too large.
- `429`: Too many sign-up and sign-in attempts from this address: at most 10 every 10 minutes, shared with sign-up and sign-in. `Retry-After` gives the seconds to wait.
- `503`: `google_unavailable`: sign-in with Google is not configured on this server, or Google could not be reached.

---

[API](https://skmtc.dev/evictionsapi/apis/evictions-api.md) · [All operations](https://skmtc.dev/evictionsapi/apis/evictions-api/llms.txt) · [OpenAPI document](https://skmtc.dev/evictionsapi/apis/evictions-api/revisions/28459213a1a3?raw)