# Authentication

Create an account and open a session for the console. Routes in this group use the portal session, not an API key.

## Create a developer account (and its first member, the owner)

`POST /auth/signup`

Authentication: none

Body (JSON):

| Field | Type | | Description |
|---|---|---|---|
| `accountName` | string | required | Name of your company or team: it identifies your account (2 to 120 characters). |
| `email` | string | required | The member's email address. It is used as the sign-in identifier and must be unique. |
| `password` | string | required | Password: at least 10 characters. |

```bash
curl -X POST "$INBOX_API/auth/signup" \
  -H "Content-Type: application/json" \
  -d '{
    "accountName": "Acme Software",
    "email": "dev@acme.com",
    "password": "un-mot-de-passe-solide"
  }'
```

Response 201:

```json
{
  "accountId": "bbfa1ecb-9483-4158-8e9a-4437e512b14b",
  "memberId": "e8878e87-7817-4773-8346-fc26a2433aa6",
  "sessionToken": "ses_91bb0d22558b4575a110844d944cca5d8b05e72328b",
  "expiresAt": "2026-12-12T08:33:45.098Z"
}
```

## Open a session

`POST /auth/login`

Authentication: none

Body (JSON):

| Field | Type | | Description |
|---|---|---|---|
| `email` | string | required | The member's email address. It is used as the sign-in identifier and must be unique. |
| `password` | string | required | Password: at least 10 characters. |

```bash
curl -X POST "$INBOX_API/auth/login" \
  -H "Content-Type: application/json" \
  -d '{
    "email": "dev@acme.com",
    "password": "un-mot-de-passe-solide"
  }'
```

Response 200:

```json
{
  "accountId": "bbfa1ecb-9483-4158-8e9a-4437e512b14b",
  "memberId": "e8878e87-7817-4773-8346-fc26a2433aa6",
  "sessionToken": "ses_9be05ed6c0764f063b187d57f0499b2eb42e7f0e4f7",
  "expiresAt": "2026-12-12T08:33:45.271Z"
}
```

## Signed-in member

`GET /auth/me`

Authentication: portal session

```bash
curl "$INBOX_API/auth/me" \
  -H "Authorization: Bearer $INBOX_SESSION"
```

Response 200:

```json
{
  "accountId": "bbfa1ecb-9483-4158-8e9a-4437e512b14b",
  "memberId": "e8878e87-7817-4773-8346-fc26a2433aa6",
  "role": "owner",
  "email": "dev@acme.com"
}
```

## Close the session

`POST /auth/logout`

Authentication: portal session

```bash
curl -X POST "$INBOX_API/auth/logout" \
  -H "Authorization: Bearer $INBOX_SESSION"
```

Response 204:

```json
(no content)
```