Sign in API
The hosted login routes.
Hosted login is a browser redirect on https://app.requestrocket.com. Send the person to /login, or to /signup for a new account. Both respond with 302. POST /token exchanges the code and state from that redirect. GET /logout needs Authorization: Bearer and a sessionId query parameter.
Endpoints
| Method | Path | What it does |
|---|---|---|
| GET | https://app.requestrocket.com/login | Redirect to hosted login |
| GET | https://app.requestrocket.com/signup | Redirect to hosted signup |
| POST | https://app.requestrocket.com/token | Exchange code and state |
| GET | https://app.requestrocket.com/logout | Sign out a session |
For a program that calls the Core API without a person signing in, create a token on API keys instead.
Exchange the authorization code
POST https://app.requestrocket.com/token reads code and state from the query string or from a JSON body. Both values come from the hosted login redirect. Pass state back unchanged.
Request body
| Parameter | Type | Required | Description |
|---|---|---|---|
code | string | ✓ | Authorization code from the hosted login redirect. |
state | string | ✓ | State value from that redirect. |
Returns the identity tokens, the session id, and the link to open next.
Response attributes
| Attribute | Type | Description |
|---|---|---|
id_token | string | Identity token. |
access_token | string | Access token. Send it as Authorization: Bearer on logout. |
refresh_token | string | Refresh token. |
token_type | string | Token type from the identity provider. |
expires_in | number | Lifetime of the access token, in seconds. |
session | string | Session id. Send it as sessionId on logout. |
redirectUrl | string | Link carried in state. |
status | number | Status reported with the token set. |
Sign out
GET https://app.requestrocket.com/logout ends the session and responds with 302. There is no JSON body.
Query parameters
| Parameter | Type | Required | Description |
|---|---|---|---|
sessionId | string | ✓ | Session id from the token exchange (session). |
link | string | Where to send the browser after sign-out. When omitted, the redirect uses the platform sign-out URL. |
A missing sessionId returns 404 with message set to No session provided. The header must be Bearer plus the access token. Any other form returns 403 with message set to Invalid Authorization Header.
Shared status codes, the 5.5 MB cap, and plan rate limits are on Platform limits.