API Reference

Auth Endpoints

The /auth/* route group covers signup, login, refresh, logout, MFA, magic links, and SSO entry points. Most callers use the dashboard for these flows; the endpoints are documented here so SDKs and custom clients can implement the same primitives.

POST/auth/login

Authentication

This endpoint is anonymous — it is the auth boundary itself. Subsequent calls use the returned access_token.

Request body

Field	Type	Required	Description
`email`	`string`	required	User email.
`password`	`string`	required	Omit when using magic-link or MFA-only flows.
`mfa_code`	`string`	optional	Required when MFA is enforced for the user.

request.json

{
  "email": "alice@acme.io",
  "password": "..."
}

Response

Returns 200 OK with the following body.

Field	Type	Required	Description
`access_token`	`string`	optional	Short-lived JWT.
`refresh_token`	`string`	optional	Long-lived refresh token (also set as HttpOnly cookie).
`user`	`object`	optional	`{ id, email, mfa_enforced }`.

200.json

{
  "access_token": "eyJ...",
  "refresh_token": "rt_01HX...",
  "user": {
    "id": 42,
    "email": "alice@acme.io",
    "mfa_enforced": true
  }
}

Errors

Status	Code	Description
400	`validation_error`	Body or query failed schema validation. The error includes the offending `field` name.
401	`unauthenticated`	Missing or invalid bearer token / API key.
403	`forbidden`	Authenticated principal lacks the required scope, role, or project access.
404	`not_found`	Target resource does not exist or is not visible to the calling tenant.
429	`rate_limited`	Per-IP or per-route limit exceeded. Respect the `Retry-After` header.
500	`internal_error`	Unhandled server error. Quote the `request_id` when contacting support.

Examples

cURL

curl -X POST https://api.memorysync.io/auth/login \
  -H "Authorization: Bearer $MEMORYSYNC_KEY" \
  -H "Content-Type: application/json" \
  -d '{
  "email": "alice@acme.io",
  "password": "..."
}'

javascript

import { MemorySync } from 'memorysync'

const client = new MemorySync({ apiKey: process.env.MEMORYSYNC_KEY })

const result = await client.request({
  method: 'POST',
  path: '/auth/login',
  body: {
    "email": "alice@acme.io",
    "password": "..."
  },
})
console.log(result)

python

from memorysync import Client

client = Client(api_key=os.environ["MEMORYSYNC_KEY"])

result = client.request(
    method="POST",
    path="/auth/login",
    json={
      "email": "alice@acme.io",
      "password": "..."
    },
)
print(result)

Behavior & notes

Companion routes: POST /auth/signup, POST /auth/refresh, POST /auth/logout, POST /auth/mfa/verify, POST /auth/magic-link, GET /sso/initiate. Login is rate-limited to 10 requests / minute / IP. Failed logins are recorded in the audit log with the source IP and user-agent.

← Previous

Billing

Integrations