API/Auth/Create an account

Create an account

POST/v1/auth/register

Email + password. Hash Argon2id, verification email sent as best-effort. The response immediately contains a full session (access + refresh) — email verification does not block it.

This English text was generated automatically from the French original and has not been reviewed yet.

signup.tstypescript

await aura.auth.signUp({
  email: 'alice@example.com',
  password: 'correct-horse-battery-staple',
})

200.jsonjson

// Same form as a successful login: the route returns a pair of tokens
{
  "data": {
    "access_token": "eyJhbGc...", "refresh_token": "...",
    "token_type": "Bearer", "expires_in": 900,
    "user": { "id": "...", "email": "alice@example.com", "email_verified": false, … }
  },
  "meta": null
}

Request

Bodysuit

Parameter	Type	Required	Description
`email`	`string`	yes	Valid email. Normalized (trim + lowercase) on the server side.
`password`	`string`	yes	Minimum 8 characters (server validation), Argon2id hash.
`name`	`string`	no	User display name.
`captcha_token`	`string`	no	CAPTCHA token, required only if CAPTCHA is enabled in the project settings.

Notes

Verification

Info

A verification email is sent as a best-effort: its failure does not cancel the registration. The account is created with email_verified: false and the session is issued anyway — it's up to your RLS policies to require verification if you wish. Confirmation is done by POST /v1/auth/verify-email, return by POST /v1/auth/resend-verification.

Attention

Limits: 5 req/min per IP to the auth router, and a quota per project of 5 successful registrations per hour per IP (rejected attempts do not consume it).

v1.0 · revised Apr 15, 2026
↗ OpenAPI spec↗ GitHub

← PREVIOUS

RPC

NEXT →