Admin Auth

Authenticate with email + password. Body: {email, password}. Returns {success, token (wsa_, 8h TTL), refresh_token (rfa_, 30d TTL)}.

Request a password reset. Body: {email}. Requires NO session. Sends the link via the AuthMailer cascade (project custom SMTP -> project Resend -> platform mail), so no per-project mail setup is needed. Always returns success — no user enumeration possible, which also means an unknown address returns success while sending nothing. Works only for an existing, active user: this endpoint alone cannot bootstrap the first admin — call create_user first.

Set a new password using a valid reset token (rst_...). Body: {token, password, password_confirmation} — all three required, password min 8 characters; omitting password_confirmation returns 422. Token is single-use and valid for 1 hour. Invalidates all active sessions. The emailed link is built server-side and always points at /reset-password.html?token=...&project=... — that page must exist in the project or the link lands on a 404. It is not created automatically; the assistant builds it, together with a forgot-password.html linked from the login page.

Verify a session token is still valid. Updates last_used_at for audit trail.

Invalidate a session token.

Exchange a refresh token (rfa_) for a new session. Rotates in-place; old tokens become invalid. Returns {success, token (new wsa_), refresh_token (new rfa_)}.

Prefer invite_user when the client cannot or should not send a password. Create a new admin user for this project. Password stored as peppered bcrypt hash. This is the only way to create an admin user — there is no dashboard screen for it, and being logged in as admin does not grant the right to create the next user (that needs the project token, not a wsa_ session). Recommended: pass a random throwaway password and then call request-reset, so the user sets their own password from the emailed link and the real password never passes through the assistant.

Create an admin user WITHOUT a password and email them a link to set their own (#1495). Preferred way to bootstrap the first admin: no credential ever passes through the assistant. The account gets an unknown random password; the user sets theirs via the emailed link to /reset-password.html (valid 1 hour; afterwards forgot-password sends a new one). Returns 409 if the user already exists and is active. Requires login.html, forgot-password.html and reset-password.html to exist in the project.

List all active admin users for this project.

No input parameters required.

Deactivate an admin user and invalidate all their active sessions.

Reset the password for an existing admin user (admin-side). Invalidates all active sessions. Note there is no change-password endpoint for a logged-in user: the browser endpoints are login, verify, logout, refresh, request-reset and reset-password only. A user changing their own password goes through request-reset -> reset-password; that is the intended route, not a fallback.

List all active sessions for this project. Shows email, IP, created_at, last_used_at.

Link a microsite project to this dashboard project. Allows wsa_ tokens to aggregate leads from linked projects.

Remove a microsite project link from this dashboard project.

List all microsite projects linked to this dashboard project.

No input parameters required.