Authentication

​

Overview

​

Endpoints

​

Sign up

• email (required): a valid email address.
• password (required): at least 6 characters.
• name (optional): display name. Defaults to the part of the email before the @.

curl -X POST https://your-app-domain/api/auth/signup \
  -H "Content-Type: application/json" \
  -d '{"email": "ada@example.com", "password": "hunter22", "name": "Ada"}'

{
  "success": true,
  "token": "<session-token>",
  "user": {
    "id": "…",
    "openId": "usr_…",
    "email": "ada@example.com",
    "name": "Ada",
    "role": "owner",
    "workspaceId": "…",
    "loginMethod": "email"
  }
}

• 400 if the email is missing or invalid.
• 400 if the password is shorter than 6 characters.
• 400 if an account with that email already exists. Sign in instead.

​

Log in

• email (required)
• password (required)

curl -X POST https://your-app-domain/api/auth/login \
  -H "Content-Type: application/json" \
  -d '{"email": "ada@example.com", "password": "hunter22"}'

​

First-login auto-provisioning

1. Creates a new user record with the email login method.
2. Creates a personal workspace named after the user (for example, “Ada’s Workspace”).
3. Assigns the user the owner role in that workspace.
4. Starts a session and returns the new user in the response.

​

Google sign-in

• email (required): the Google account email.
• name (optional): display name. Defaults to the part of the email before the @.

curl -X POST https://your-app-domain/api/auth/google \
  -H "Content-Type: application/json" \
  -d '{"email": "ada@example.com", "name": "Ada"}'

​

Get the current user

curl https://your-app-domain/api/auth/me \
  -H "Authorization: Bearer <session-token>"

• With a valid session, the response contains the user object.
• Without a session, or with an invalid or expired token, the response is { "user": null }.

​

Log out

curl -X POST https://your-app-domain/api/auth/logout

​

Sessions

• Sessions last one year from sign-up or sign-in.
• Agent Lab delivers the session token as an HTTP cookie and also accepts it as a Bearer token in the Authorization header.
• Signing in again refreshes the user’s last-signed-in timestamp.

​

Session cookie behavior

• Over HTTPS, Agent Lab sets the cookie with Secure and SameSite=None, so cross-site embeds keep working.
• Over plain HTTP, such as localhost during local development, Agent Lab sets SameSite=Lax without Secure. Browsers reject Secure cookies on insecure connections, so this fallback keeps sessions working locally.

​

Bearer token fallback

curl https://your-app-domain/api/auth/me \
  -H "Authorization: Bearer <token-from-login-response>"