Sessions

The full session model (ES256 tokens, rotation + theft detection, lockout) is in Sessions; this is the endpoint reference.

Authenticate

POST/v1/auth/signupSign up → token pair

POST/v1/auth/loginPassword login → token pair

POST/v1/auth/magic-link/startEmail a magic link

POST/v1/auth/magic-link/consumeConsume → token pair

Exchange the refresh token for a fresh, rotated pair. Replaying a rotated token revokes the chain.

POST/v1/auth/refreshRotate the token pair

Bash

curl -X POST https://api.qeetid.com/v1/auth/refresh \
  -H "Content-Type: application/json" \
  -d '{"refresh_token":"…"}'

GET/v1/auth/meCurrent user/tenant/session context

Bash

curl https://api.qeetid.com/v1/auth/me \
  -H "Authorization: Bearer $ACCESS_TOKEN"

GET/v1/auth/sessionsList the caller's sessions

DELETE/v1/auth/sessions/{id}Revoke a session

POST/v1/auth/logoutRevoke the current session

Verify access tokens locally against the JWKS rather than calling the API on every request — that's what the SDKs' sessions.verify() does.