Accounts endpoints
Token minting, staff listing, hand-off and invitation routes outside /api/auth.
Issues a 15-minute RS256 JWT (audience dylog-services) for the caller in the organization named by org. Accepts the session cookie or an organization API key in x-api-key. Unlike /api/auth/token it never depends on the session's active organization. Claims: sub, email, name, org_id, org_slug, org_role, org_meta.client-code, is_staff.
Browser session cookie (set by sign-in)
In: cookie
Query Parameters
Organization slug
Response Body
application/json
curl -X GET "https://example.com/api/token?org=string"{ "token": "string"}Target of the invitation email. Stores the invitation in a short-lived cookie and routes new users to sign-up (sign-up is invitation-only) or existing users to accept it.
Path Parameters
Response Body
curl -X GET "https://example.com/invite/string"Browser entry point for other Dylog services. Redirects to the sign-in UI and, after success, back to next (must be an exact origin from the RETURN_TO_ORIGINS allowlist). /account?next= and /account/security?next= work the same way.
Query Parameters
Absolute URL to return to
uriResponse Body
curl -X GET "https://example.com/sign-in"