Authentication

Session token

Most /v0 routes require an Authorization: Bearer <session> header obtained after login or completed sign-up.

Sign-up sequence

Typical order for new API integrators:

1. POST /v0/auth/sign-up/start
2. POST /v0/auth/sign-up/verify-pin
3. POST /v0/auth/sign-up/complete
4. POST /v0/auth/login (if a separate login step is required for your client)

Password reset (forgot password)

Gated by modules.web.authentication.passwordReset.enabled on the deployment. License key only — no session.

1. POST /v0/auth/password-reset/start — { "email" } → resetToken (unknown emails still acknowledge success)
2. POST /v0/auth/password-reset/verify-pin — { "resetToken", "pin" } (6-digit code from email)
3. POST /v0/auth/password-reset/resend-pin — optional; same resetToken
4. POST /v0/auth/password-reset/complete — { "resetToken", "password" }

Password must be at least 8 characters and include a letter and a number. Complete terminates all existing sessions and does not return a new session — call POST /v0/auth/login afterwards.

RapidAPI / external gateway

When traffic arrives through RapidAPI, gateway identity and subscription headers are injected by the runtime. Consumer samples should use RapidAPI’s key headers — not Kolony internal license secrets.

See Errors & limits for plan and entitlement behaviour.