Sign-in and session

Get a session token with a local account, refresh it, and read who you are signed in as. Browser single sign-on is not part of this API.

📄️Sign in with a local account

Exchange an email and password for a session. This is the only sign-in that works without a browser, so it is the way a script or service obtains a token for this API. Browser single sign-on (Microsoft Entra ID) is separate.

📄️Get the signed-in identity

Returns who the token belongs to, the tenant, the role and the list of permissions the role grants. The server enforces permissions on every call; this list is for building your own UI.

📄️Refresh a session

Swap a refresh token for a new access token and a new refresh token. Use the new refresh token next time.