Get an access token

How it works

Send your flow2act email and password privately over HTTPS. No AWS account, client ID, client secret, API key or prior browser session is required. This is the flow2act JSON sign-in API, not an OAuth password-grant endpoint. Never paste passwords or returned tokens into LLM prompts, logs or source control.

When status=authenticated, use accessToken as FLOW2ACT_ACCESS_TOKEN in Authorization: Bearer. expiresAt and expiresIn describe its lifetime. Keep refreshToken on your backend for renewal; tokens grant only the authenticated user’s current organization permissions. Resolve your organization with POST /v1/workspace {}, then send its ID in X-Organization-Id. A Live administrator can invite users including admins; a users:invite service key can invite ordinary members only.

A temporary password or MFA returns status=challenge_required with challenge and a short-lived opaque challengeToken. Complete POST /v1/auth/challenge before any access token is issued. Invalid credentials return 401, required email verification/password recovery 409, throttling 429. Per-instance protection allows 20 token/challenge requests per IP per minute; do not retry login in a tight loop.

Workspace access requires an enrolled authenticator. Complete /security in the browser first. Every API request validates the token online and refreshes group membership. Sign-out revokes all current Cognito sessions. API sign-in may return a standard MFA challenge.

Request body

Request essentials

Authorization

Not required

X-Organization-Id

Not required