Sign in users: email, tokens and API keys

In the Anythink dashboard

1. Open Settings › Users.
2. In the User access card, tick Allow registrations.
3. Choose a Default role for new users. Administrator roles aren't offered here.
4. Tick Require email confirmation for new users if users must confirm their address before they sign in.
5. Click Save.

With the CLI

With an AI assistant (MCP)

In the Anythink dashboard

To add a user yourself rather than let them register:

1. Open Settings › Users and click Create Project User.
2. Enter the First Name, Last Name and Email, and choose a Role.
3. Click Create Project User. Anythink emails the user an invitation to set their own password. See Invite people and team members.

With the CLI

The CLI has no command for end-user registration. Call the endpoint with anythink fetch, which adds the active project's path for you:

anythink fetch /auth/v1/register --method POST --body '{
  "first_name": "Alice",
  "last_name": "Smith",
  "email": "alice@example.com",
  "password": "Str0ng!passphrase"
}'

With an AI assistant (MCP)

Register alice@example.com as a user in this project, first name Alice, last name Smith.

The assistant uses the cli tool to fetch /auth/v1/register. To create a user without choosing a password for them, ask it to invite them instead: it creates the user with fetch /users, which sends the invitation. Connect an AI assistant sets up the MCP server.

The raw request:

POST /org/{project_id}/auth/v1/register
Content-Type: application/json

{
  "first_name": "Alice",
  "last_name": "Smith",
  "email": "alice@example.com",
  "password": "Str0ng!passphrase"
}

Registration successful

Optionally add referral_code, or a signup_context object with utm_source, utm_medium, utm_campaign, utm_term, utm_content, referrer and signup_country. Anythink records the context against the new user.

The rules:

A request that breaks a rule returns 400 with an errors object listing each failed field, for example:

{
  "title": "One or more validation errors occurred.",
  "status": 400,
  "errors": {
    "Password": [
      "Password must be at least 8 characters long",
      "Password must contain at least one uppercase letter"
    ]
  }
}

In the Anythink dashboard

An administrator can fix a stuck account without a token. Open the user under Settings › Users, then click Resend Confirmation Email or Mark as Confirmed.

With the CLI

anythink fetch '/auth/v1/resend-confirm-email?email=alice@example.com' --method POST

To confirm a user without an email, an administrator can call anythink fetch /users/42/mark-as-confirmed --method POST, using the user's ID from anythink users list.

With an AI assistant (MCP)

Resend the confirmation email to alice@example.com, or mark user 42 as confirmed.

In the Anythink dashboard

Your own app provides the sign-in screen, so there is nothing to configure per sign-in. To check that an account can sign in, open Settings › Users. A user who has confirmed their address and has an active account shows Active. A user who hasn't accepted an invitation shows Invite Sent.

With the CLI

anythink fetch /auth/v1/token --method POST --body '{
  "email": "alice@example.com",
  "password": "Str0ng!passphrase"
}'

The CLI itself signs in as you, not as an end user. Use anythink users me to see which account the CLI is using. See Get started with the CLI.

With an AI assistant (MCP)

Sign in alice@example.com with her password and tell me when the access token expires.

The assistant uses the cli tool to fetch /auth/v1/token. Anything you paste into a chat passes through the assistant, so use a test account, not a real user's password.

The raw request:

POST /org/{project_id}/auth/v1/token
Content-Type: application/json

{
  "email": "alice@example.com",
  "password": "Str0ng!passphrase"
}

{
  "access_token": "eyJhbGciOiJIUzI1NiIs…",
  "refresh_token": "OW+kSomn10…",
  "expires_in": 1800
}

In the Anythink dashboard

Open Settings › Users to see each user's role, status and last login. Open a user to see their confirmation and invitation details.

With the CLI

anythink users me

This shows the account the CLI is using. To see another user, run anythink users get 42.

With an AI assistant (MCP)

Show me the current user, and the user with ID 42.

The raw request:

GET /org/{project_id}/users/me
Authorization: Bearer eyJhbGciOiJIUzI1NiIs…

{
  "id": 42,
  "gid": "368f7b33-940e-4aad-a3d8-5a28215935bd",
  "first_name": "Alice",
  "last_name": "Smith",
  "email": "alice@example.com",
  "role_id": 104,
  "role_name": "Standard User",
  "is_active": true,
  "confirmed_at": "2026-10-04T13:31:50.114391Z",
  "last_login_at": "2026-10-04T13:31:50.307407Z",
  "auth_provider": null,
  "permissions": [
    { "name": "orders:read", "description": "…", "is_active": true }
  ]
}

The response carries more fields than shown. permissions lists everything the user's role allows, so your app can show or hide controls. These related endpoints take the same bearer token:

Without a valid token, GET /users/me returns 401.

With the CLI

anythink fetch /auth/v1/refresh --method POST --body '{ "token": "OW+kSomn10…" }'

With an AI assistant (MCP)

Refresh this session with the refresh token in my REFRESH_TOKEN variable.

With the CLI

anythink fetch /auth/v1/logout --method POST --body '{ "token": "d4Qm1xZ8…" }'

anythink logout is different: it removes the CLI's own saved profile, and doesn't sign an end user out.

With an AI assistant (MCP)

Sign out the session with the refresh token in my REFRESH_TOKEN variable.

In the Anythink dashboard

Your app provides the forgot-password screen, so use the endpoints below.

With the CLI

anythink fetch '/auth/v1/send-password-reset?email=alice@example.com' --method POST

anythink fetch /auth/v1/confirm-password-reset --method POST --body '{
  "email": "alice@example.com",
  "token": "482913",
  "password": "An0ther!passphrase"
}'

With an AI assistant (MCP)

Send a password reset email to alice@example.com.

The assistant uses the cli tool to fetch /auth/v1/send-password-reset. Finish the reset in your app, so the new password never passes through the chat.

The raw requests:

POST /org/{project_id}/auth/v1/send-password-reset?email=alice@example.com

This always returns 204 No Content, whether or not the address belongs to a user, so it can't be used to find out who has an account. It sends at most one email a minute per user.

POST /org/{project_id}/auth/v1/confirm-password-reset
Content-Type: application/json

{
  "email": "alice@example.com",
  "token": "482913",
  "password": "An0ther!passphrase"
}

The reset code is single use. Requesting a new reset replaces any earlier code. The email comes from your project's password reset template (Email templates).

In the Anythink dashboard

Your app provides the change-password screen, so use the endpoint below.

With the CLI

anythink fetch /users/me/password --method PUT --body '{
  "current_password": "Str0ng!passphrase",
  "new_password": "An0ther!passphrase"
}'

This changes the password of the account the CLI is signed in as.

With an AI assistant (MCP)

Change passwords in the dashboard or in your app, not in a chat.

The raw request:

PUT /org/{project_id}/users/me/password
Authorization: Bearer eyJhbGciOiJIUzI1NiIs…
Content-Type: application/json

{
  "current_password": "Str0ng!passphrase",
  "new_password": "An0ther!passphrase"
}

It returns 204 No Content. The next sign-in uses the new password. Choose a new password that meets the password rules.

In the Anythink dashboard

1. Open Settings › Users and click Create Project User.
2. Enter the name and Email, choose a Role, and click Create Project User. The invitation is sent.
3. To follow up, open the user and use Resend Invitation Email. The users list shows Invite Sent until they accept.

With the CLI

anythink fetch /users --method POST --body '{"first_name":"Alice","last_name":"Smith","email":"alice@example.com","role_id":104}'

Find role IDs with anythink roles list.

With an AI assistant (MCP)

Invite alice@example.com, Alice Smith, as a Standard User.

The assistant runs roles list to find the role, then creates the user with fetch /users.

When the user opens the link, your app (or the hosted page) completes the invitation. Both calls need no token:

GET /org/{project_id}/users/invites/{invite_token}

This returns the invited user's name, email and role, so you can pre-fill your form. An unknown or expired token returns 404.

POST /org/{project_id}/users/invites/{invite_token}
Content-Type: application/json

{
  "first_name": "Alice",
  "last_name": "Smith",
  "password": "Str0ng!passphrase"
}

It returns 204 No Content, and the user can then sign in with that email and password. A bad token returns 400 Invalid invite token. The password follows the password rules.

For teams, roles, project switching and access across several projects, see Manage app users and team members.