Authentication
Log in for a one-day access token, or send an API key as a bearer token. There is no register route.
Log in
POST /api/v1/{locale}/auth/login{
"email": "string",
"password": "string"
}A successful login returns { "accessToken": "string" }. The token is valid for one day. Send it on every other request:
Authorization: Bearer <accessToken>Wrong credentials return invalid_credentials with status 401. A missing or expired token returns unauthorized with status 401.
API keys
Create an API key in your account settings. It goes in the same Authorization: Bearer header and does not expire on its own, which makes it the better choice for long-running automation.
An API key carries your permissions. It is not a separate service account, so website access and role slices apply exactly as they do when you sign in.
Session-based access
The admin panel uses a browser session cookie, not a bearer token. API and MCP calls never accept the cookie, so a client that only has a session must log in or use a key.
Related
- Conventions for the error shape every auth failure uses.
- Your account for creating and rotating API keys.