Sign-in and session API reference

Updated Nov 13, 2026

20 operations of the Fax for Agents API, from the OpenAPI document version 1.20.0, snapshot of 2026-11-13. The base URL is https://api.faxforagents.com/v1. This is one group of the full reference.

POST /v1/auth/magic-links always answers 202, whether or not the address has an account.
Idempotency-Key is accepted but ignored on the session-only authentication actions.
Accepting an invitation needs the signed-in email to match the invited one.

Operations

POST /v1/auth/invitations/{token}/accept Join the organization an invitation link names (the signed-in email must match)
POST /v1/auth/logout End this session
POST /v1/auth/magic-links Send a sign-in link to an email address (always 202)
GET /v1/auth/magic-links/{token} Open a sign-in link: sets the session cookie and redirects to the app
GET /v1/auth/me The signed-in person, their organizations and the CSRF token
GET /v1/auth/oauth/{provider}/callback Finish GitHub or Google sign-in (the app forwards its /auth/{provider}/callback here)
GET /v1/auth/oauth/{provider}/start Begin GitHub or Google sign-in (redirects to the provider)
GET /v1/auth/passkeys Your passkeys
POST /v1/auth/passkeys/login/options Options for navigator.credentials.get() (discoverable, no email needed)
POST /v1/auth/passkeys/login/verify Sign in with a passkey assertion
POST /v1/auth/passkeys/register/options Options for navigator.credentials.create() (fresh session required)
POST /v1/auth/passkeys/register/verify Store a new passkey after the browser created it
DELETE /v1/auth/passkeys/{passkey_id} Remove one of your passkeys
GET /v1/auth/providers Which sign-in methods are available
POST /v1/auth/reauth Prove it is you again (passkey now, or a fresh link by mail) before a sensitive action
POST /v1/auth/review-access Sign in with reviewer credentials
DELETE /v1/auth/sessions Sign out everywhere else
GET /v1/auth/sessions Your live sessions
DELETE /v1/auth/sessions/{session_id} Revoke one of your sessions
POST /v1/auth/switch-organization Look at another organization you belong to

Who is the auth group for?

For a browser. These operations sign a person in to the dashboard and manage that person's sessions and passkeys. None of them takes an API key. A script that sends faxes authenticates with a key from the identity group and never calls this group.

The group is in the public document because the dashboard is a client of the same API. Reading it tells you what a session is and what a sensitive action asks of a person.

GET /v1/auth/providers says which methods are on: magic links, passkeys, GitHub and Google. It takes no credential.

A magic link starts with POST /v1/auth/magic-links and an email address. The answer is always 202, so the call does not reveal whether an address has an account. Opening the link, GET /v1/auth/magic-links/{token}, sets the session cookie and redirects to the app.

A passkey sign-in is two calls. POST /v1/auth/passkeys/login/options returns the options for navigator.credentials.get(), discoverable, so no email is typed. POST /v1/auth/passkeys/login/verify takes the assertion and signs the person in.

GitHub and Google use GET /v1/auth/oauth/{provider}/start, which redirects to the provider, and /callback, which finishes the sign-in. Both answer 503 when the provider is not configured.

What does a signed-in session carry?

GET /v1/auth/me returns the person, the organization being looked at, the other organizations, the passkeys, the providers and the CSRF token. POST /v1/auth/switch-organization changes which organization the session looks at. POST /v1/auth/logout ends the session.

A person can read the live sessions with GET /v1/auth/sessions and revoke one by id. DELETE /v1/auth/sessions revokes every other one, which the summary calls "sign out everywhere else".

What is re-authentication for?

Some actions need proof that the person at the keyboard is still the account's owner: approving a send, registering a passkey, turning on auto-send. POST /v1/auth/reauth gives that proof. With a passkey it answers 200 at once. With the mail method it answers 202 and sends a fresh link.

Registering a passkey is POST /v1/auth/passkeys/register/options, which needs a fresh session, then /register/verify with the credential the browser created. GET /v1/auth/passkeys lists a person's passkeys and DELETE removes one.

POST /v1/auth/invitations/{token}/accept joins the organization an invitation link names. The signed-in email has to match the invited address. The invitation itself is created in the members group.

POST /v1/auth/review-access signs in with reviewer credentials, an email and a code. It takes no session and answers 401 when the pair is wrong.

Why do these calls ignore Idempotency-Key?

The OpenAPI document repeats one sentence on these operations. The header is accepted but ignored for a session-only authentication action. A repeat creates no customer resource and no charge. Authentication, one-time challenge checks and rate limits still apply. So a retried sign-in call is safe, and a one-time link or challenge still works once.

Each operation in detail

POST `/v1/auth/invitations/{token}/accept`

Join the organization an invitation link names (the signed-in email must match)

Credential: a signed-in session.

Parameters

POST /v1/auth/invitations/{token}/accept parameters
Name	In	Type	Required	Notes
`token`	path	string	yes
`Idempotency-Key`	header	string	no	Replay the first successful response for the same request within 24 hours. Reusing the idempotency header with a different request returns 409 idempotency_key_conflict. Responses include Idempotent-Replayed: true on replay.

Responses

POST /v1/auth/invitations/{token}/accept responses
Status	Meaning
`200`	Successful Response
`401`	No credential, or one that was not accepted: invalid_token for an API key, unauthenticated where a signed-in session is needed. error.details.reason says why a key was refused.
`403`	The credential is valid and is not allowed to do this. scope_missing puts the scope in error.details.scope. Other codes are agent_forbidden and approval_required. A session can also meet csrf_invalid and reauth_required.
`404`	not_found: no such resource for this credential. A resource of another organization answers the same.
`409`	The resource is in a state that refuses the call, or the Idempotency-Key was used with a different request (idempotency_key_conflict). error.code names the state.
`422`	A field failed validation: invalid_request, with one entry per field in error.details, or a code that names the rule.
`429`	rate_limited. Retry-After and the RateLimit-* headers say when to try again.

Response fields

POST /v1/auth/invitations/{token}/accept response fields
Field	Type	Required	Description
`organization`	object OrganizationSummary	yes

Example

curl https://api.faxforagents.com/v1/auth/invitations/TOKEN/accept \
  -X POST

POST `/v1/auth/logout`

End this session

Idempotency-Key is accepted but ignored for this session-only authentication action. Repeated requests do not create customer resources or charges. Authentication, one-time challenge checks and rate limits still apply.

Credential: a signed-in session.

Responses

POST /v1/auth/logout responses
Status	Meaning
`204`	Successful Response
`401`	No credential, or one that was not accepted: invalid_token for an API key, unauthenticated where a signed-in session is needed. error.details.reason says why a key was refused.
`403`	The credential is valid and is not allowed to do this. scope_missing puts the scope in error.details.scope. Other codes are agent_forbidden and approval_required. A session can also meet csrf_invalid and reauth_required.
`429`	rate_limited. Retry-After and the RateLimit-* headers say when to try again.

Example

curl https://api.faxforagents.com/v1/auth/logout \
  -X POST

POST `/v1/auth/magic-links`

Send a sign-in link to an email address (always 202)

Credential: none.

Request body application/json, required

POST /v1/auth/magic-links request body
Field	Type	Required	Description
`email`	string (email)	yes
`next`	string or null	no	An in-app path to open after sign-in.
`ref`	string or null	no	A referral code from the link that brought the person, when the page has one.
`sub`	string or null	no	The referral link's tag.

Responses

POST /v1/auth/magic-links responses
Status	Meaning
`202`	Successful Response
`422`	A field failed validation: invalid_request, with one entry per field in error.details, or a code that names the rule.
`429`	rate_limited. Retry-After and the RateLimit-* headers say when to try again.

Response fields

POST /v1/auth/magic-links response fields
Field	Type	Required	Description
`message`	string	yes
`sent`	boolean	yes

Example

curl https://api.faxforagents.com/v1/auth/magic-links \
  -X POST \
  -H "Content-Type: application/json" \
  -d '{"email":"reader@example.com"}'

GET `/v1/auth/magic-links/{token}`

Open a sign-in link: sets the session cookie and redirects to the app

Credential: none.

Parameters

GET /v1/auth/magic-links/{token} parameters
Name	In	Type	Required	Notes
`token`	path	string	yes

Responses

GET /v1/auth/magic-links/{token} responses
Status	Meaning
`303`	Redirect to the app, signed in or with an error code in the query.
`422`	A field failed validation: invalid_request, with one entry per field in error.details, or a code that names the rule.
`429`	rate_limited. Retry-After and the RateLimit-* headers say when to try again.

Example

curl https://api.faxforagents.com/v1/auth/magic-links/TOKEN

GET `/v1/auth/me`

The signed-in person, their organizations and the CSRF token

Credential: a signed-in session.

Responses

GET /v1/auth/me responses
Status	Meaning
`200`	Successful Response
`401`	No credential, or one that was not accepted: invalid_token for an API key, unauthenticated where a signed-in session is needed. error.details.reason says why a key was refused.
`429`	rate_limited. Retry-After and the RateLimit-* headers say when to try again.

Response fields

GET /v1/auth/me response fields
Field	Type	Required	Description
`csrf_token`	string	yes
`default_environment`	string (live, test)	no	The environment the dashboard opens on: live once the organization has a funded wallet or a paid one-time order, else test.
`organization`	object OrganizationSummary or null	yes
`organizations`	array of object OrganizationSummary	yes
`passkeys`	integer	yes
`providers`	object Providers	yes
`session`	object SessionInfo	yes
`user`	object UserOut	yes

Example

curl https://api.faxforagents.com/v1/auth/me

GET `/v1/auth/oauth/{provider}/callback`

Finish GitHub or Google sign-in (the app forwards its /auth/{provider}/callback here)

Credential: none.

Parameters

GET /v1/auth/oauth/{provider}/callback parameters
Name	In	Type	Required	Notes
`provider`	path	string	yes
`code`	query	string	no	Default `""`.
`state`	query	string	no	Default `""`.
`error`	query	string or null	no

Responses

GET /v1/auth/oauth/{provider}/callback responses
Status	Meaning
`200`	Successful Response
`400`	The request cannot be read or is refused as sent, for example invalid_request.
`401`	No credential, or one that was not accepted: invalid_token for an API key, unauthenticated where a signed-in session is needed. error.details.reason says why a key was refused.
`403`	The credential is valid and is not allowed to do this. scope_missing puts the scope in error.details.scope. Other codes are agent_forbidden and approval_required. A session can also meet csrf_invalid and reauth_required.
`404`	not_found: no such resource for this credential. A resource of another organization answers the same.
`422`	A field failed validation: invalid_request, with one entry per field in error.details, or a code that names the rule.
`429`	rate_limited. Retry-After and the RateLimit-* headers say when to try again.
`503`	Something this call depends on is not available or not set up here, for example billing_unavailable or provider_unavailable. error.retryable says whether to send the same call again.

Response fields

GET /v1/auth/oauth/{provider}/callback response fields
Field	Type	Required	Description
`csrf_token`	string	yes
`default_environment`	string (live, test)	no	The environment the dashboard opens on: live once the organization has a funded wallet or a paid one-time order, else test.
`organization`	object OrganizationSummary or null	yes
`organizations`	array of object OrganizationSummary	yes
`passkeys`	integer	yes
`providers`	object Providers	yes
`session`	object SessionInfo	yes
`user`	object UserOut	yes

Example

curl https://api.faxforagents.com/v1/auth/oauth/PROVIDER/callback

GET `/v1/auth/oauth/{provider}/start`

Begin GitHub or Google sign-in (redirects to the provider)

Credential: none.

Parameters

GET /v1/auth/oauth/{provider}/start parameters
Name	In	Type	Required	Notes
`provider`	path	string	yes
`next`	query	string or null	no
`ref`	query	string or null	no	A referral code from the link.
`sub`	query	string or null	no	The referral link's tag.

Responses

GET /v1/auth/oauth/{provider}/start responses
Status	Meaning
`303`	Successful Response
`404`	not_found: no such resource for this credential. A resource of another organization answers the same.
`422`	A field failed validation: invalid_request, with one entry per field in error.details, or a code that names the rule.
`429`	rate_limited. Retry-After and the RateLimit-* headers say when to try again.
`503`	Something this call depends on is not available or not set up here, for example billing_unavailable or provider_unavailable. error.retryable says whether to send the same call again.

Example

curl https://api.faxforagents.com/v1/auth/oauth/PROVIDER/start

GET `/v1/auth/passkeys`

Your passkeys

Credential: a signed-in session.

Responses

GET /v1/auth/passkeys responses
Status	Meaning
`200`	Successful Response
`401`	No credential, or one that was not accepted: invalid_token for an API key, unauthenticated where a signed-in session is needed. error.details.reason says why a key was refused.
`429`	rate_limited. Retry-After and the RateLimit-* headers say when to try again.

Response fields

GET /v1/auth/passkeys response fields
Field	Type	Required	Description
`items`	array of object Passkey	yes

Example

curl https://api.faxforagents.com/v1/auth/passkeys

POST `/v1/auth/passkeys/login/options`

Options for navigator.credentials.get() (discoverable, no email needed)

Credential: none.

Responses

POST /v1/auth/passkeys/login/options responses
Status	Meaning
`200`	Successful Response
`429`	rate_limited. Retry-After and the RateLimit-* headers say when to try again.

Example

curl https://api.faxforagents.com/v1/auth/passkeys/login/options \
  -X POST

POST `/v1/auth/passkeys/login/verify`

Credential: none.

Request body application/json, required

POST /v1/auth/passkeys/login/verify request body
Field	Type	Required	Description
`credential`	object	yes

Responses

POST /v1/auth/passkeys/login/verify responses
Status	Meaning
`200`	Successful Response
`400`	The request cannot be read or is refused as sent, for example invalid_request.
`401`	No credential, or one that was not accepted: invalid_token for an API key, unauthenticated where a signed-in session is needed. error.details.reason says why a key was refused.
`403`	The credential is valid and is not allowed to do this. scope_missing puts the scope in error.details.scope. Other codes are agent_forbidden and approval_required. A session can also meet csrf_invalid and reauth_required.
`422`	A field failed validation: invalid_request, with one entry per field in error.details, or a code that names the rule.
`429`	rate_limited. Retry-After and the RateLimit-* headers say when to try again.

Response fields

POST /v1/auth/passkeys/login/verify response fields
Field	Type	Required	Description
`csrf_token`	string	yes
`default_environment`	string (live, test)	no	The environment the dashboard opens on: live once the organization has a funded wallet or a paid one-time order, else test.
`organization`	object OrganizationSummary or null	yes
`organizations`	array of object OrganizationSummary	yes
`passkeys`	integer	yes
`providers`	object Providers	yes
`session`	object SessionInfo	yes
`user`	object UserOut	yes

Example

curl https://api.faxforagents.com/v1/auth/passkeys/login/verify \
  -X POST \
  -H "Content-Type: application/json" \
  -d '{"credential":{}}'

POST `/v1/auth/passkeys/register/options`

Options for navigator.credentials.create() (fresh session required)

Credential: a signed-in session.

Responses

POST /v1/auth/passkeys/register/options responses
Status	Meaning
`200`	Successful Response
`401`	No credential, or one that was not accepted: invalid_token for an API key, unauthenticated where a signed-in session is needed. error.details.reason says why a key was refused.
`403`	The credential is valid and is not allowed to do this. scope_missing puts the scope in error.details.scope. Other codes are agent_forbidden and approval_required. A session can also meet csrf_invalid and reauth_required.
`429`	rate_limited. Retry-After and the RateLimit-* headers say when to try again.

Example

curl https://api.faxforagents.com/v1/auth/passkeys/register/options \
  -X POST

POST `/v1/auth/passkeys/register/verify`

Store a new passkey after the browser created it

Credential: a signed-in session.

Parameters

POST /v1/auth/passkeys/register/verify parameters
Name	In	Type	Required	Notes
`Idempotency-Key`	header	string	no	Replay the first successful response for the same request within 24 hours. Reusing the idempotency header with a different request returns 409 idempotency_key_conflict. Responses include Idempotent-Replayed: true on replay.

Request body application/json, required

POST /v1/auth/passkeys/register/verify request body
Field	Type	Required	Description
`credential`	object	yes
`label`	string or null	no

Responses

POST /v1/auth/passkeys/register/verify responses
Status	Meaning
`201`	Successful Response
`400`	The request cannot be read or is refused as sent, for example invalid_request.
`401`	No credential, or one that was not accepted: invalid_token for an API key, unauthenticated where a signed-in session is needed. error.details.reason says why a key was refused.
`403`	The credential is valid and is not allowed to do this. scope_missing puts the scope in error.details.scope. Other codes are agent_forbidden and approval_required. A session can also meet csrf_invalid and reauth_required.
`409`	The resource is in a state that refuses the call, or the Idempotency-Key was used with a different request (idempotency_key_conflict). error.code names the state.
`422`	A field failed validation: invalid_request, with one entry per field in error.details, or a code that names the rule.
`429`	rate_limited. Retry-After and the RateLimit-* headers say when to try again.

Response fields

POST /v1/auth/passkeys/register/verify response fields
Field	Type	Required
`aaguid`	string or null	yes
`backup_eligible`	boolean	yes
`created_at`	string	yes
`id`	string	yes
`label`	string or null	yes
`last_used_at`	string or null	yes
`transports`	array of string or null	yes

Example

curl https://api.faxforagents.com/v1/auth/passkeys/register/verify \
  -X POST \
  -H "Content-Type: application/json" \
  -d '{"credential":{}}'

DELETE `/v1/auth/passkeys/{passkey_id}`

Remove one of your passkeys

Credential: a signed-in session.

Parameters

DELETE /v1/auth/passkeys/{passkey_id} parameters
Name	In	Type	Required	Notes
`passkey_id`	path	string	yes
`Idempotency-Key`	header	string	no	Replay the first successful response for the same request within 24 hours. Reusing the idempotency header with a different request returns 409 idempotency_key_conflict. Responses include Idempotent-Replayed: true on replay.

Responses

DELETE /v1/auth/passkeys/{passkey_id} responses
Status	Meaning
`204`	Successful Response
`401`	No credential, or one that was not accepted: invalid_token for an API key, unauthenticated where a signed-in session is needed. error.details.reason says why a key was refused.
`403`	The credential is valid and is not allowed to do this. scope_missing puts the scope in error.details.scope. Other codes are agent_forbidden and approval_required. A session can also meet csrf_invalid and reauth_required.
`404`	not_found: no such resource for this credential. A resource of another organization answers the same.
`409`	The resource is in a state that refuses the call, or the Idempotency-Key was used with a different request (idempotency_key_conflict). error.code names the state.
`422`	A field failed validation: invalid_request, with one entry per field in error.details, or a code that names the rule.
`429`	rate_limited. Retry-After and the RateLimit-* headers say when to try again.

Example

curl https://api.faxforagents.com/v1/auth/passkeys/PASSKEY_ID \
  -X DELETE

GET `/v1/auth/providers`

Which sign-in methods are available

Credential: none.

Responses

GET /v1/auth/providers responses
Status	Meaning
`200`	Successful Response

Response fields

GET /v1/auth/providers response fields
Field	Type	Required
`github`	boolean	yes
`google`	boolean	yes
`magic_link`	boolean	no
`passkeys`	boolean	no

Example

curl https://api.faxforagents.com/v1/auth/providers

POST `/v1/auth/reauth`

Prove it is you again (passkey now, or a fresh link by mail) before a sensitive action

Credential: a signed-in session.

Request body application/json, required

POST /v1/auth/reauth request body
Field	Type	Required	Description
`credential`	object or null	no
`method`	string (passkey, magic_link)	yes

Responses

POST /v1/auth/reauth responses
Status	Meaning
`200`	Successful Response
`202`	A sign-in link was sent; opening it in this browser refreshes the session.
`400`	The request cannot be read or is refused as sent, for example invalid_request.
`401`	No credential, or one that was not accepted: invalid_token for an API key, unauthenticated where a signed-in session is needed. error.details.reason says why a key was refused.
`403`	The credential is valid and is not allowed to do this. scope_missing puts the scope in error.details.scope. Other codes are agent_forbidden and approval_required. A session can also meet csrf_invalid and reauth_required.
`422`	A field failed validation: invalid_request, with one entry per field in error.details, or a code that names the rule.
`429`	rate_limited. Retry-After and the RateLimit-* headers say when to try again.

Response fields

POST /v1/auth/reauth response fields
Field	Type	Required	Description
`csrf_token`	string	yes
`default_environment`	string (live, test)	no	The environment the dashboard opens on: live once the organization has a funded wallet or a paid one-time order, else test.
`organization`	object OrganizationSummary or null	yes
`organizations`	array of object OrganizationSummary	yes
`passkeys`	integer	yes
`providers`	object Providers	yes
`session`	object SessionInfo	yes
`user`	object UserOut	yes

Example

curl https://api.faxforagents.com/v1/auth/reauth \
  -X POST \
  -H "Content-Type: application/json" \
  -d '{"method":"passkey"}'

POST `/v1/auth/review-access`

Credential: none.

Request body application/json, required

POST /v1/auth/review-access request body
Field	Type	Required	Description
`code`	string (password)	yes
`email`	string (email)	yes

Responses

POST /v1/auth/review-access responses
Status	Meaning
`200`	Successful Response
`401`	No credential, or one that was not accepted: invalid_token for an API key, unauthenticated where a signed-in session is needed. error.details.reason says why a key was refused.
`422`	A field failed validation: invalid_request, with one entry per field in error.details, or a code that names the rule.
`429`	rate_limited. Retry-After and the RateLimit-* headers say when to try again.

Response fields

POST /v1/auth/review-access response fields
Field	Type	Required	Description
`csrf_token`	string	yes
`default_environment`	string (live, test)	no	The environment the dashboard opens on: live once the organization has a funded wallet or a paid one-time order, else test.
`organization`	object OrganizationSummary or null	yes
`organizations`	array of object OrganizationSummary	yes
`passkeys`	integer	yes
`providers`	object Providers	yes
`session`	object SessionInfo	yes
`user`	object UserOut	yes

Example

curl https://api.faxforagents.com/v1/auth/review-access \
  -X POST \
  -H "Content-Type: application/json" \
  -d '{"email":"reader@example.com","code":"example"}'

DELETE `/v1/auth/sessions`

Sign out everywhere else

Credential: a signed-in session.

Responses

DELETE /v1/auth/sessions responses
Status	Meaning
`200`	Successful Response
`401`	No credential, or one that was not accepted: invalid_token for an API key, unauthenticated where a signed-in session is needed. error.details.reason says why a key was refused.
`403`	The credential is valid and is not allowed to do this. scope_missing puts the scope in error.details.scope. Other codes are agent_forbidden and approval_required. A session can also meet csrf_invalid and reauth_required.
`429`	rate_limited. Retry-After and the RateLimit-* headers say when to try again.

Response fields

DELETE /v1/auth/sessions response fields
Field	Type	Required	Description
`revoked`	integer	yes

Example

curl https://api.faxforagents.com/v1/auth/sessions \
  -X DELETE

GET `/v1/auth/sessions`

Your live sessions

Credential: a signed-in session.

Responses

GET /v1/auth/sessions responses
Status	Meaning
`200`	Successful Response
`401`	No credential, or one that was not accepted: invalid_token for an API key, unauthenticated where a signed-in session is needed. error.details.reason says why a key was refused.
`429`	rate_limited. Retry-After and the RateLimit-* headers say when to try again.

Response fields

GET /v1/auth/sessions response fields
Field	Type	Required	Description
`items`	array of object SessionOut	yes

Example

curl https://api.faxforagents.com/v1/auth/sessions

DELETE `/v1/auth/sessions/{session_id}`

Revoke one of your sessions

Credential: a signed-in session.

Parameters

DELETE /v1/auth/sessions/{session_id} parameters
Name	In	Type	Required	Notes
`session_id`	path	string	yes

Responses

DELETE /v1/auth/sessions/{session_id} responses
Status	Meaning
`204`	Successful Response
`401`	No credential, or one that was not accepted: invalid_token for an API key, unauthenticated where a signed-in session is needed. error.details.reason says why a key was refused.
`403`	The credential is valid and is not allowed to do this. scope_missing puts the scope in error.details.scope. Other codes are agent_forbidden and approval_required. A session can also meet csrf_invalid and reauth_required.
`404`	not_found: no such resource for this credential. A resource of another organization answers the same.
`422`	A field failed validation: invalid_request, with one entry per field in error.details, or a code that names the rule.
`429`	rate_limited. Retry-After and the RateLimit-* headers say when to try again.

Example

curl https://api.faxforagents.com/v1/auth/sessions/SESSION_ID \
  -X DELETE

POST `/v1/auth/switch-organization`

Look at another organization you belong to

Credential: a signed-in session.

Request body application/json, required

POST /v1/auth/switch-organization request body
Field	Type	Required	Description
`org_id`	string	yes

Responses

POST /v1/auth/switch-organization responses
Status	Meaning
`200`	Successful Response
`401`	No credential, or one that was not accepted: invalid_token for an API key, unauthenticated where a signed-in session is needed. error.details.reason says why a key was refused.
`403`	The credential is valid and is not allowed to do this. scope_missing puts the scope in error.details.scope. Other codes are agent_forbidden and approval_required. A session can also meet csrf_invalid and reauth_required.
`404`	not_found: no such resource for this credential. A resource of another organization answers the same.
`422`	A field failed validation: invalid_request, with one entry per field in error.details, or a code that names the rule.
`429`	rate_limited. Retry-After and the RateLimit-* headers say when to try again.

Response fields

POST /v1/auth/switch-organization response fields
Field	Type	Required	Description
`csrf_token`	string	yes
`default_environment`	string (live, test)	no	The environment the dashboard opens on: live once the organization has a funded wallet or a paid one-time order, else test.
`organization`	object OrganizationSummary or null	yes
`organizations`	array of object OrganizationSummary	yes
`passkeys`	integer	yes
`providers`	object Providers	yes
`session`	object SessionInfo	yes
`user`	object UserOut	yes

Example

curl https://api.faxforagents.com/v1/auth/switch-organization \
  -X POST \
  -H "Content-Type: application/json" \
  -d '{"org_id":"org_example"}'

Sign-in and session API reference

Operations

Who is the auth group for?

Which sign-in methods are there?

What does a signed-in session carry?

What is re-authentication for?

How do invitations and reviewers sign in?

Why do these calls ignore Idempotency-Key?

Each operation in detail

POST /v1/auth/invitations/{token}/accept

Parameters

Responses

Response fields

Example

POST /v1/auth/logout

Responses

Example

POST /v1/auth/magic-links

Request body application/json, required

Responses

Response fields

Example

GET /v1/auth/magic-links/{token}

Parameters

Responses

Example

GET /v1/auth/me

Responses

Response fields

Example

GET /v1/auth/oauth/{provider}/callback

Parameters

Responses

Response fields

Example

GET /v1/auth/oauth/{provider}/start

Parameters

Responses

Example

GET /v1/auth/passkeys

Responses

Response fields

Example

POST /v1/auth/passkeys/login/options

Responses

Example

POST /v1/auth/passkeys/login/verify

Request body application/json, required

Responses

Response fields

Example

POST /v1/auth/passkeys/register/options

Responses

Example

POST /v1/auth/passkeys/register/verify

Parameters

Request body application/json, required

Responses

Response fields

Example

DELETE /v1/auth/passkeys/{passkey_id}

Parameters

Responses

Example

GET /v1/auth/providers

Responses

Response fields

Example

POST /v1/auth/reauth

Request body application/json, required

Responses

Response fields

Example

POST /v1/auth/review-access

Request body application/json, required

Responses

Response fields

Example

DELETE /v1/auth/sessions

Responses

POST `/v1/auth/invitations/{token}/accept`

POST `/v1/auth/logout`

POST `/v1/auth/magic-links`

GET `/v1/auth/magic-links/{token}`

GET `/v1/auth/me`

GET `/v1/auth/oauth/{provider}/callback`

GET `/v1/auth/oauth/{provider}/start`

GET `/v1/auth/passkeys`

POST `/v1/auth/passkeys/login/options`

POST `/v1/auth/passkeys/login/verify`

POST `/v1/auth/passkeys/register/options`

POST `/v1/auth/passkeys/register/verify`

DELETE `/v1/auth/passkeys/{passkey_id}`

GET `/v1/auth/providers`

POST `/v1/auth/reauth`

POST `/v1/auth/review-access`

DELETE `/v1/auth/sessions`

GET `/v1/auth/sessions`

DELETE `/v1/auth/sessions/{session_id}`

POST `/v1/auth/switch-organization`