Login
Authenticate users and issue JWT tokens.
Login
Authenticate users and issue JWT tokens. Login is an email passcode flow. The X-App-Id header establishes app context and keeps authentication rate limits scoped to the requesting application.
Initiate Login
POST /v1/auths/login/initiate
Start login by requesting an email passcode. The response is deliberately generic and does not reveal whether the email belongs to an account: If an account matches, login instructions will be sent.
| Field | Type | Required | Description |
|---|---|---|---|
email | string | yes | User's email address. |
https://cloud.vanitypass.com with X-Environment: Sandbox. No real bookings or charges. Production access: contact us./v1/auths/login/initiateSandbox credentials
Keys never leave your browser — they are sent only to cloud.vanitypass.com with X-Environment: Sandbox.
curl -X POST 'https://cloud.vanitypass.com/v1/auths/login/initiate' \
-H 'Content-Type: application/json' \
-H 'X-Environment: Sandbox' \
-d '{"email":"user@example.com"}'Complete Login
POST /v1/auths/login
Complete login with the emailed passcode. Returns access_token and refresh_token on success. Use email; user_id remains an optional legacy identifier and must not be sent together with email.
| Field | Type | Required | Description |
|---|---|---|---|
email | string | conditionally | User's email address. Preferred; required when user_id is omitted. |
user_id | string (uuid) | conditionally | Legacy account identifier; required when email is omitted. |
passcode | string | yes | The emailed six-digit passcode. |
https://cloud.vanitypass.com with X-Environment: Sandbox. No real bookings or charges. Production access: contact us./v1/auths/loginSandbox credentials
Keys never leave your browser — they are sent only to cloud.vanitypass.com with X-Environment: Sandbox.
curl -X POST 'https://cloud.vanitypass.com/v1/auths/login' \
-H 'Content-Type: application/json' \
-H 'X-Environment: Sandbox' \
-d '{"email":"user@example.com","passcode":"123456"}'Authentication attempts are limited to 5 per 10 minutes per normalized identifier and application. A 429 response includes a dynamic Retry-After header.
Refresh Token
POST /v1/auths/refresh
Refresh an access token using a valid refresh token. Access tokens are short-lived; use this endpoint to obtain a new one without requiring the user to log in again.
| Field | Type | Required | Description |
|---|---|---|---|
refresh_token | string | yes | The refresh token issued at login. |
https://cloud.vanitypass.com with X-Environment: Sandbox. No real bookings or charges. Production access: contact us./v1/auths/refreshSandbox credentials
Keys never leave your browser — they are sent only to cloud.vanitypass.com with X-Environment: Sandbox.
curl -X POST 'https://cloud.vanitypass.com/v1/auths/refresh' \
-H 'Content-Type: application/json' \
-H 'X-Environment: Sandbox' \
-d '{"refresh_token":"rt_example"}'Logout
POST /v1/auths/logout
Revoke tokens and end the session. Both the access token and refresh token are invalidated. Subsequent requests using these tokens will receive 401 Unauthorized.
https://cloud.vanitypass.com with X-Environment: Sandbox. No real bookings or charges. Production access: contact us./v1/auths/logoutSandbox credentials
Keys never leave your browser — they are sent only to cloud.vanitypass.com with X-Environment: Sandbox.
curl -X POST 'https://cloud.vanitypass.com/v1/auths/logout' \ -H 'Content-Type: application/json' \ -H 'X-Environment: Sandbox' \