Skip to main content

Authentication API

The current production sign-in path is Google through Circle, followed by a Veyra application-session exchange.

Google/Circle device bootstrap​

POST /api/v1/auth/circle/social/device/

This starts the Circle social-device flow used by the browser login experience.

Exchange Circle identity for a Veyra session​

POST /api/v1/auth/circle/exchange/

The backend validates Circle-authenticated identity state before creating or restoring the Veyra user/session.

Browser-supplied identity text is not accepted as sufficient identity proof by itself.

Current user​

GET /api/v1/auth/me/

Returns the authenticated Veyra user plus role/capability and onboarding state used by the frontend workspace resolver.

A user can hold more than one product capability. The workspace resolver can therefore send a dual-role user to the combined workspace rather than forcing one permanent role.

Logout​

POST /api/v1/auth/logout/

Revokes the Veyra application session and clears the application session cookie.

Capability onboarding​

POST /api/v1/onboarding/client/
POST /api/v1/onboarding/agent-owner/

Capabilities are additive.

Email-code endpoints​

The backend still contains compatibility routes under the Circle email namespace, but email-code sign-in is disabled in the current production experience.

The user-facing rule is:

Continue with Google

Do not build a new integration around the old email-code flow unless the product explicitly re-enables it.

Session security​

Production sessions use secure application cookies. Browser JavaScript does not need to store a long-lived Veyra bearer token in local storage.