Authentication

Register

Creates a new tenant (workspace) and its first user, who is assigned the owner role.

POST /api/v1/auth/register

{
  "tenant_slug": "acme",
  "tenant_name": "Acme Corp",
  "email": "founder@acme.com",
  "password": "correct horse battery staple"
}

Response 201 Created

{
  "token": "<jwt>",
  "user": { "id": "...", "email": "founder@acme.com", "role": "owner", "tenant_id": "..." },
  "tenant": { "id": "...", "slug": "acme", "name": "Acme Corp", "plan": "free" }
}

tenant_slug must be unique platform-wide. Save the token for subsequent Authorization: Bearer headers.

Login

POST /api/v1/auth/login

{
  "tenant_slug": "acme",
  "email": "founder@acme.com",
  "password": "correct horse battery staple"
}

Response 200 OK — same shape as register: { "token", "user", "tenant" }.

Single Sign-On (SSO)

For tenants with SSO configured (SAML/OIDC), the login flow is browser-based:

Endpoint	Description
GET /api/v1/auth/sso/check?tenant_slug=acme	Returns whether SSO is enabled for a tenant and which provider.
GET /api/v1/auth/sso/authorize?tenant_slug=acme	Redirects the browser to the configured IdP.
GET /api/v1/auth/sso/callback	IdP redirects back here; the server validates the assertion/token, creates or updates the user, and redirects to the frontend with a JWT.

Sign in with Google

Separate from the Google connector OAuth flow (different redirect URI, registered separately with Google):

Endpoint	Description
GET /api/v1/auth/google/authorize	Redirects to Google's consent screen for "Sign in with Google".
GET /api/v1/auth/google/callback	Exchanges the code, finds-or-creates a user/tenant, redirects to the frontend with a JWT.

Platform API keys

For scripts and CI that need to call the API without a browser login flow:

POST /api/v1/api-keys
{ "name": "ci-deploy-key" }

Response 201 Created

{ "key": "goa_...", "name": "ci-deploy-key", "note": "store this key securely — it will not be shown again" }

Use it as Authorization: Bearer goa_... — it carries the same tenant/role as the user who created it.

Tenant info

GET /api/v1/tenant

Returns the current tenant's record (id, slug, name, plan, organization_id, ...).