Authenticate management operations

Creating and managing Landing Pages and Assets requires an account. Signing in returns an access token and a refresh token. Send the access token in the Authorization header as Bearer <token>. Set the API URL and token values without storing them in the repository:

export LPDATA_API_URL="https://api.lpdata.io"
export LPDATA_ACCESS_TOKEN="<access_token>"
export LPDATA_REFRESH_TOKEN="<refresh_token>"

Create an account

POST /auth/sign_up accepts account details inside user:

curl --request POST "$LPDATA_API_URL/auth/sign_up" \
  --header 'Content-Type: application/json' \
  --data '{"user":{"email":"owner@example.com","password":"<your-password>","password_confirmation":"<your-password>"}}'

A successful signup returns 201 Created and the tokens:

{
  "user": { "id": 42, "email": "owner@example.com" },
  "access_token": "<access_token>",
  "refresh_token": "<refresh_token>"
}

POST /auth/sign_in uses user.email and user.password:

curl --request POST "$LPDATA_API_URL/auth/sign_in" \
  --header 'Content-Type: application/json' \
  --data '{"user":{"email":"owner@example.com","password":"<your-password>"}}'

Invalid credentials return 401 Unauthorized:

{ "errors": ["Invalid email or password"] }

Get the authenticated account

GET /auth/me returns the identity associated with the access token:

curl "$LPDATA_API_URL/auth/me" \
  --header "Authorization: Bearer $LPDATA_ACCESS_TOKEN"

{ "user": { "id": 42, "email": "owner@example.com" } }

Without a valid token, the endpoint returns 401 Unauthorized.

Refresh tokens

Send the refresh token in the body of POST /auth/refresh. The response contains a new pair of tokens; the previous refresh token is invalidated and must not be reused.

curl --request POST "$LPDATA_API_URL/auth/refresh" \
  --header 'Content-Type: application/json' \
  --data "{\"refresh_token\":\"$LPDATA_REFRESH_TOKEN\"}"

An invalid or expired token returns 401 Unauthorized with Invalid or expired refresh token.

Sign out

DELETE /auth/sign_out revokes the access token in the header and the refresh token in the body. On success, it returns 204 No Content.

curl --request DELETE "$LPDATA_API_URL/auth/sign_out" \
  --header "Authorization: Bearer $LPDATA_ACCESS_TOKEN" \
  --header 'Content-Type: application/json' \
  --data "{\"refresh_token\":\"$LPDATA_REFRESH_TOKEN\"}"

Use the new token pair after a refresh and discard revoked tokens after signing out.

Get started

Manage content

Reference

Authentication

Authenticate management operations

Create an account

Get the authenticated account

Refresh tokens

Sign out

​Authenticate management operations

​Create an account

​Sign in

​Get the authenticated account

​Refresh tokens

​Sign out

Authenticate management operations

Create an account

Sign in

Get the authenticated account

Refresh tokens

Sign out