id_token from POST /auth/v1/signin as
Authorization: Bearer <id_token> — not the access_token, which does not carry the identity we
authorize on. One token works across every Cloud Humans API, and the account you reach is derived
from it, so there is nothing else to configure.
Sign in below to get one.
Your password goes to
api.cloudhumans.com, and nowhere else. It is sent there once, over
HTTPS, to get you a token — this page makes no other request with it, stores nothing, and logs
nothing. You can confirm that in your browser’s network tab.api.cloudhumans.com is also the only place your token should ever go. Any other site offering
to “check” or “decode” it for you is not one to trust.Not every sign-in ends in a token
Accounts with a temporary password, or with two-step verification turned on, come back with a challenge instead: no token yet, and asession to answer it with. The form above handles
that for you — the second step appears only when there is one, already carrying what the first
step returned.
Building this into your own client means writing a loop rather than a single call, because
answering a challenge can return another one:
Branch on the body, not on the status — both outcomes are
200. A first-access user who also
has two-step verification really does go NEW_PASSWORD_REQUIRED → SMS_MFA → token, and each
step returns a new session that replaces the one before it.
Three details worth knowing before your own client meets a real user:
Send the code as a string. Codes can start with a zero, and "012345" parsed into a JSON
number is a different code. A number is rejected with a 400 rather than coerced, precisely so
this shows up on your first test instead of as one user in ten who “can’t log in”.
A wrong code and an expired session look identical. Both come back
400 CodeMismatchException, so your UI cannot honestly say which happened. Offer a retry, and
next to it a way back to the start — retrying against an expired session never recovers.
The session is not yours to keep. It belongs to one sign-in attempt, so there is nothing to
persist and nothing to resume. When it stops being accepted, the only move is /auth/v1/signin
again, which sends a fresh code.
Full request and response shapes are on the
sign-in and
challenge pages.