Sign in
Auth

Headless password sign-in + auto-minted PAT

Changed on

Password sign-in for CLI / agent callers. Returns the Supabase session AND a freshly-minted Bearer PAT in a single response so the caller can immediately authenticate subsequent requests without a browser.

post/api/v1/auth/signin

Request

  • Base URL: http://localhost:3000
  • URL: http://localhost:3000/api/v1/auth/signin
  • Auth: none declared

Request body

emailstring email required
passwordstring required
pat_namestring
pat_scopesstring[]

workspace:admin is NOT accepted here and returns 403 forbidden, even though the enum lists it — the enum is the shared capability vocabulary, not the set this route grants. Headless auth carries no workspace_id, and an admin-scoped token must target one specific workspace, so the guard rejects the scope outright. Mint admin-scoped tokens through POST /api/v1/tokens with a workspace_id instead. Omit this field to get the defaults: atc:read, atc:write, run:execute. See ADR-0005.

pat_expires_in_daysinteger

Example request

{
  "email": "qa.user@example.com"
}

Response

Authenticated.

warningstring required

Changes

  • 4528999528c6Revision changes
    • warning

      added the new test_outside_plan_project enum value to the / response property for the response status

    • warning

      added the new test_outside_plan_project enum value to the / response property for the response status

    • warning

      added the new test_outside_plan_project enum value to the / response property for the response status

  • 2ca74ff5fec5Revision changes
    • info

      removed the test_outside_plan_project enum value from the / response property for the response status

    • info

      removed the test_outside_plan_project enum value from the / response property for the response status

    • info

      removed the test_outside_plan_project enum value from the / response property for the response status