---
title: "Signup"
method: POST
path: "/onboarding/signup"
tags: ["onboarding"]
---

# Signup

`POST /onboarding/signup`

## Request

- Base URL: `https://api.getathly.com` (the document declares no server; this is the origin it was published from)
- URL: `https://api.getathly.com/onboarding/signup`
- Auth: none declared

A create-account submission with no token: work out who this is.

Unauthenticated of necessity -- nobody arriving here has a session -- and so
throttled, since an unauthenticated endpoint that answers questions about an
address is one an attacker will ask repeatedly. What it can be made to admit
is bounded rather than eliminated: the paid-vs-not bit, and the same bit any
sign-in screen gives up about whether a login exists. Wording is uniform
within a branch so nothing finer than that gets out.

## Request body

- SignupRequest: A tokenless create-account submission, scoped to the athlete in the URL. The slug comes from the path rather than remembered client state: one email can be paid for one athlete and unknown for another, so the pair is the identity and guessing it wrong would route someone to the wrong answer.
  - `email` string, email, required
  - `password` string, required
  - `athlete_slug` string, required
  - `timezone` string, nullable

## Response `200`

Successful Response

- SignupResponse
  - `action` 'signed_in' | 'check_inbox' | 'start_onboarding', required
  - `session` ClaimSessionResponse: A real session, so a paid signup goes straight into the app.
    - `access_token` string, required
    - `refresh_token` string, required
    - `expires_at` integer, required
    - `user_id` string, required
    - `athlete_slug` string, required
  - `offer` SignupOffer: The one button offered alongside a session. Never a redirect. Bouncing between domains is always a button press, so this is data for the screen to render rather than a location to follow.
    - `kind` 'finish_checkout' | 'start_onboarding', required
    - `url` string, required
  - `intake_conflict` boolean

## Other responses

- `422`: Validation Error

---

[API](https://skmtc.dev/getathly/apis/athly-api.md) - [All operations](https://skmtc.dev/getathly/apis/athly-api/llms.txt) - [OpenAPI document](https://skmtc.dev/getathly/apis/athly-api/revisions/6adfdc258d75?raw)