Sign-in and account POST endpoints
The web app's sign-in and account endpoints, one operation per method for every path under /api/auth/ ({*}): sign-up and sign-in with email and password, sign-in with an emailed code (existing accounts only) and with GitHub or Google where the instance configures them, sessions, two-factor authentication, deleting one's own account, organizations, members, invitations and teams, administration and, with MCP OAuth on, the OAuth authorization server. They are for the web app only: their requests and answers follow its needs and can change in any version. Integrations use /api/v1 with an API key (keys are managed under /api/v1/orgs/{orgId}/api-keys, not here). The exception is the OAuth authorization server of MCP clients: its standard endpoints are the ones its metadata names (/.well-known/oauth-authorization-server/api/auth, RFC 8414): /api/auth/oauth2/authorize, POST /api/auth/oauth2/token, POST /api/auth/oauth2/revoke and GET /api/auth/jwks; a system administrator registers a client with POST /api/auth/oauth2/create-client. The endpoints apply their own CSRF, Origin and rate limit checks.
session__Secure-pilotfox.session_token<token>The web app's sign-in session, acting with the user's role; named pilotfox.session_token on an instance whose PUBLIC_URL is plain http. Under /api/v1, a POST, PUT, PATCH or DELETE carrying a cookie must come from the instance's own origin (Origin: PUBLIC_URL or a DASHBOARD_ORIGINS entry; else 403), and a body it carries must be JSON or multipart (else 415).
**stringThe endpoint's answer, whose shape depends on the path
response?unknownapplication/jsonThe endpoint's answer, whose shape depends on the path
curl -X POST 'https://pilotfox.app/api/auth/string'null