Authentication API

These operations work on the token you call them with. Use them to check that a token is valid and which account it belongs to, to read the signed-in user’s profile, or to end a session. Create embed token mints the short-lived token an embedded request log uses. How to send a token is covered in the introduction.

Get user profile #

GET https://api.apitraffic.io/v1/authentication/me

Returns the profile of the person a session token belongs to, the accounts they are a member of, and their sign-in and multi-factor settings. This is the call the app makes when it opens.

Permissions: a user session. API tokens and OAuth access tokens do not belong to a person, so call Verify token with those instead.

Response #

• sid (string, required): The user’s identifier (usr_…).

• firstName (string): First name.

• lastName (string): Last name.

• email (string, required): Email address used to sign in.

• timezone (string): The user’s IANA time zone, for example America/New_York.

• defaultAccountSid (string, required): The first account in accounts.

• defaultBucketSid (string | null): The bucket this person chose to open by default in the current account, or null.

• defaultEnvironmentSid (string | null): The environment this person chose to open by default in the current account, or null.

• createdAt (string, required): When the user was created (ISO 8601).

• emailVerified (boolean, required): Whether the email address has been confirmed.

• identities (object[], required): The sign-in methods linked to this user.

identity

• sid (string): Identifier of the sign-in method.

• provider (string): password, or the name of the sign-in provider.

• email (string): The email address the method signs in with.

• emailVerified (boolean): Whether that address is confirmed.

• lastLoginAt (string | null): Last sign-in with this method.

• createdAt (string): When the method was linked.

• mfaEnabled (boolean, required): Whether any second factor is set up.

• mfaTotpEnabled (boolean, required): Whether an authenticator app is set up.

• mfaSmsEnabled (boolean, required): Whether text-message codes are set up.

• mfaPhoneLast4 (string | null): The last four digits of the phone number used for codes.

• mfaEnrolledAt (string | null): When the first factor was set up (ISO 8601).

• accounts (object[], required): Every account the user is a member of.

account

• sid (string): Account identifier.

• name (string): Account name.

• role (string): The user’s role in that account: owner, admin or member.

• isPrimary (boolean): Whether this user is the account’s primary member.

• createdAt (string): When the user joined the account.

• chat (object, required): Support chat settings for the app. userHash is null when chat is not configured.

curl https://api.apitraffic.io/v1/authentication/me \
  -H "Authorization: Bearer $APITRAFFIC_SESSION_TOKEN"

const response = await fetch('https://api.apitraffic.io/v1/authentication/me', {
  headers: { Authorization: `Bearer ${process.env.APITRAFFIC_SESSION_TOKEN}` },
});
const me = await response.json();
console.log(me.email, me.accounts.map((account) => account.name));

{
  "sid": "usr_2jL4kM6nB8vC1xZ3aS5dF7gH9qW",
  "firstName": "Jordan",
  "lastName": "Lee",
  "email": "[email protected]",
  "timezone": "America/New_York",
  "defaultAccountSid": "acc_2mXq7RbT4kPz9WvN3cHd8LsYfQa",
  "defaultBucketSid": "k3m9p2x",
  "defaultEnvironmentSid": "prd7k2",
  "createdAt": "2026-03-02T15:20:11.000Z",
  "emailVerified": true,
  "identities": [
    {
      "sid": "uid_2wE4rT6yU8iO1pA3sD5fG7hJ9kL",
      "provider": "password",
      "email": "[email protected]",
      "emailVerified": true,
      "lastLoginAt": "2026-10-19T13:02:44.000Z",
      "createdAt": "2026-03-02T15:20:11.000Z"
    }
  ],
  "mfaEnabled": true,
  "mfaTotpEnabled": true,
  "mfaSmsEnabled": false,
  "mfaPhoneLast4": null,
  "mfaEnrolledAt": "2026-03-02T15:31:40.000Z",
  "accounts": [
    {
      "sid": "acc_2mXq7RbT4kPz9WvN3cHd8LsYfQa",
      "name": "Acme Store",
      "isPrimary": true,
      "role": "owner",
      "createdAt": "2026-03-02T15:20:11.000Z"
    }
  ],
  "chat": { "userHash": null }
}

Verify token #

GET https://api.apitraffic.io/v1/authentication/verify

Checks that a token is valid and returns the account it belongs to. Works with API tokens, user sessions and OAuth access tokens, so it is a cheap way for a script to confirm its credentials before doing real work.

Permissions: any valid token except an ingest API token.

Response #

• accountSid (string, required): The account the token belongs to.

curl https://api.apitraffic.io/v1/authentication/verify \
  -H "Authorization: Bearer $APITRAFFIC_TOKEN"

const response = await fetch('https://api.apitraffic.io/v1/authentication/verify', {
  headers: { Authorization: `Bearer ${process.env.APITRAFFIC_TOKEN}` },
});
if (!response.ok) throw new Error(`Token rejected: ${response.status}`);
const { accountSid } = await response.json();

{
  "accountSid": "acc_2mXq7RbT4kPz9WvN3cHd8LsYfQa"
}

Sign out #

GET https://api.apitraffic.io/v1/authentication/signout

Ends the session the token belongs to. The token stops working immediately, and the sign-out is recorded in the account history.

Permissions: a user session. To stop an API token working, delete it instead.

Response #

• successful (boolean, required): true when the session was ended.

curl https://api.apitraffic.io/v1/authentication/signout \
  -H "Authorization: Bearer $APITRAFFIC_SESSION_TOKEN"

await fetch('https://api.apitraffic.io/v1/authentication/signout', {
  headers: { Authorization: `Bearer ${process.env.APITRAFFIC_SESSION_TOKEN}` },
});

{
  "successful": true
}

Create embed token #

POST https://api.apitraffic.io/v1/accounts/{accountSid}/embeds/token

Creates a short-lived, signed token for an embedded request log inside your own application. The bucket and filters are locked into the token, so a viewer can only see the traffic you chose. Call this from your server, never from the browser, and hand only the resulting token to the page. The embed’s own read endpoints, authenticated with this token, are described in the embed guide.

Plan: needs a plan that includes Embeds. Permissions: owner or admin, or an API token with the administrator role. Members, user tokens and ingest tokens are refused with 403 and code 2010. An embed token reads the account’s captured traffic, so keep the token you mint it with on your server.

Path parameters #

• accountSid (path, string, required): The account identifier.

Body parameters #

• bucketSid (body, string, required): The bucket the embed shows.

• filters (body, object): Filters locked into the token: environmentSid, criteria (the search syntax; inside a double-quoted value, escape " as \" and \ as \\) and streamViewSid.

• ttl (body, integer, default 3600): How long the token is valid, 60 to 86400 seconds.

• theme (body, string, default light): light, dark or auto.

• tabs (body, string[]): The request detail tabs the embed may show: request, response, connection, waf, related, workflows, tags, waterfall, traces, trace, concurrency, ai. Data for a tab you leave out is never returned. Omit for the default set (request, response, connection, workflows, tags, traces, ai); send [] to hide request detail entirely.

• features (body, object): copyRequest (offer “Copy request” code, which shows headers and the query string) and includeBodies (show request and response bodies). Both default to false.

• view (body, string, default request-log): The embed view. request-log is the only one.

Response #

• token (string, required): The signed embed token.

• expiresAt (string, required): When it expires (ISO 8601).

• tabs (string[], required): The tabs the token allows, after unknown ones are dropped and defaults applied.

• features (object, required): The features the token enables.

curl -X POST https://api.apitraffic.io/v1/accounts/acc_2mXq7RbT4kPz9WvN3cHd8LsYfQa/embeds/token \
  -H "Authorization: Bearer $APITRAFFIC_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "bucketSid": "k3m9p2x",
    "filters": { "environmentSid": "prd7k2", "criteria": "tag:customer == \"cus_1042\"" },
    "ttl": 900
  }'

const accountSid = 'acc_2mXq7RbT4kPz9WvN3cHd8LsYfQa';
const response = await fetch(`https://api.apitraffic.io/v1/accounts/${accountSid}/embeds/token`, {
  method: 'POST',
  headers: {
    Authorization: `Bearer ${process.env.APITRAFFIC_TOKEN}`,
    'Content-Type': 'application/json',
  },
  body: JSON.stringify({
    bucketSid: 'k3m9p2x',
    filters: { environmentSid: 'prd7k2', criteria: 'tag:customer == "cus_1042"' },
    ttl: 900,
  }),
});
const { token, expiresAt } = await response.json();

{
  "token": "eyJhbGciOiJIUzI1NiJ9.eyJidWNrZXRTaWQiOiJrM205cDJ4In0.c2lnbmF0dXJl",
  "expiresAt": "2026-10-20T13:15:00.000Z",
  "tabs": ["request", "response", "connection", "workflows", "tags", "traces", "ai"],
  "features": { "copyRequest": false, "includeBodies": false }
}

Errors #

Related #

• API tokens API: Create and revoke the tokens your scripts use.

• Sign-in and security: Sign-in methods and multi-factor authentication.