Skip to content
Kindgi

Sign in to the console with an API token

POST
/v1/auth/token-sign-in
curl --request POST \
  --url https://example.com/v1/auth/token-sign-in \
  --header 'Authorization: Bearer <token>'

The API token in Authorization is exchanged once for a browser session in the session cookie (HttpOnly; the same as a sign-in with an identity provider), so the browser never keeps the token. Only a person’s full key opens a session: a service account’s key, or a narrowed one (a member role, or one project), is refused 403 token-sign-in-not-allowed. The session ends after its lifetime, or when the key expires if sooner. 403 token-sign-in-off when the deployment doesn’t allow it (always mounted, so a console gets that answer); 400 token-sign-in-needs-an-api-token when the request is already signed in by a session.

Authorizations

Section titled “Authorizations”

Responses

Section titled “Responses”

200

Section titled “200”

Signed in: the session cookie is set.

Media typeapplication/json
object
userId
required

The person now signed in.

string
>= 1 characters
expiresAt
required

When the session ends at the latest: its lifetime, or the key’s expiry if sooner.

string format: date-time
Examplegenerated
{
  "userId": "example",
  "expiresAt": "2026-04-15T12:00:00Z"
}

400

Section titled “400”

Signed in by a session, not an API token (token-sign-in-needs-an-api-token).

Media typeapplication/json
object
error
required
object
code
required

Stable machine-readable discriminant. Values match domain error codes (see docs/API-ROUTE-CONVENTIONS.md §4.3).

string
message
required
string
details

Optional, kind-specific.

object
key
additional properties
any
requestId
required

Server-assigned request id; also echoed via X-Request-Id header.

string
Examplegenerated
{
  "error": {
    "code": "example",
    "message": "example",
    "details": {},
    "requestId": "example"
  }
}

401

Section titled “401”

Missing / malformed / expired / revoked bearer token.

Media typeapplication/json
object
error
required
object
code
required

Stable machine-readable discriminant. Values match domain error codes (see docs/API-ROUTE-CONVENTIONS.md §4.3).

string
message
required
string
details

Optional, kind-specific.

object
key
additional properties
any
requestId
required

Server-assigned request id; also echoed via X-Request-Id header.

string
Examplegenerated
{
  "error": {
    "code": "example",
    "message": "example",
    "details": {},
    "requestId": "example"
  }
}

403

Section titled “403”

Not allowed here (token-sign-in-off), or not this key (token-sign-in-not-allowed): a service account’s, or a narrowed one.

Media typeapplication/json
object
error
required
object
code
required

Stable machine-readable discriminant. Values match domain error codes (see docs/API-ROUTE-CONVENTIONS.md §4.3).

string
message
required
string
details

Optional, kind-specific.

object
key
additional properties
any
requestId
required

Server-assigned request id; also echoed via X-Request-Id header.

string
Examplegenerated
{
  "error": {
    "code": "example",
    "message": "example",
    "details": {},
    "requestId": "example"
  }
}

409

Section titled “409”

A retry with the Idempotency-Key of a sign-in that succeeded: its session was in the cookie, which isn’t kept (idempotency-key-replay-withheld). Sign in again without the key.

Media typeapplication/json
object
error
required
object
code
required

Stable machine-readable discriminant. Values match domain error codes (see docs/API-ROUTE-CONVENTIONS.md §4.3).

string
message
required
string
details

Optional, kind-specific.

object
key
additional properties
any
requestId
required

Server-assigned request id; also echoed via X-Request-Id header.

string
Examplegenerated
{
  "error": {
    "code": "example",
    "message": "example",
    "details": {},
    "requestId": "example"
  }
}