# Authentication API

> Read the signed-in user's profile, check which account a token belongs to, end a session, and mint short-lived embed tokens with the ApiTraffic REST API.

Source: https://www.apitraffic.io/docs/api-reference/authentication

These operations work on the token you call them with. Use them to check that a token is valid and which account it belongs to, to read the signed-in user's profile, or to end a session. [Create embed token](#create-embed-token) mints the short-lived token an embedded request log uses. How to send a token is covered in the [introduction](https://www.apitraffic.io/docs/api-reference/introduction#authentication).

## Get user profile

`GET https://api.apitraffic.io/v1/authentication/me`

Returns the profile of the person a session token belongs to, the accounts they are a member of, and their sign-in and multi-factor settings. This is the call the app makes when it opens.

**Permissions:** a user session. API tokens and OAuth access tokens do not belong to a person, so call [Verify token](#verify-token) with those instead.

### Response

- **sid (string, required)**:
  The user's identifier (`usr_…`).

- **firstName (string)**:
  First name.

- **lastName (string)**:
  Last name.

- **email (string, required)**:
  Email address used to sign in.

- **timezone (string)**:
  The user's IANA time zone, for example `America/New_York`.

- **defaultAccountSid (string, required)**:
  The first account in `accounts`.

- **defaultBucketSid (string | null)**:
  The bucket this person chose to open by default in the current account, or `null`.

- **defaultEnvironmentSid (string | null)**:
  The environment this person chose to open by default in the current account, or `null`.

- **createdAt (string, required)**:
  When the user was created (ISO 8601).

- **emailVerified (boolean, required)**:
  Whether the email address has been confirmed.

- **identities (object[], required)**:
  The sign-in methods linked to this user.

**identity**

- **sid (string)**:
      Identifier of the sign-in method.

- **provider (string)**:
      `password`, or the name of the sign-in provider.

- **email (string)**:
      The email address the method signs in with.

- **emailVerified (boolean)**:
      Whether that address is confirmed.

- **lastLoginAt (string | null)**:
      Last sign-in with this method.

- **createdAt (string)**:
      When the method was linked.

- **mfaEnabled (boolean, required)**:
  Whether any second factor is set up.

- **mfaTotpEnabled (boolean, required)**:
  Whether an authenticator app is set up.

- **mfaSmsEnabled (boolean, required)**:
  Whether text-message codes are set up.

- **mfaPhoneLast4 (string | null)**:
  The last four digits of the phone number used for codes.

- **mfaEnrolledAt (string | null)**:
  When the first factor was set up (ISO 8601).

- **accounts (object[], required)**:
  Every account the user is a member of.

**account**

- **sid (string)**:
      Account identifier.

- **name (string)**:
      Account name.

- **role (string)**:
      The user's role in that account: `owner`, `admin` or `member`.

- **isPrimary (boolean)**:
      Whether this user is the account's primary member.

- **createdAt (string)**:
      When the user joined the account.

- **chat (object, required)**:
  Support chat settings for the app. `userHash` is `null` when chat is not configured.

```bash cURL
curl https://api.apitraffic.io/v1/authentication/me \
  -H "Authorization: Bearer $APITRAFFIC_SESSION_TOKEN"
```

```js Node.js
const response = await fetch('https://api.apitraffic.io/v1/authentication/me', {
  headers: { Authorization: `Bearer ${process.env.APITRAFFIC_SESSION_TOKEN}` },
});
const me = await response.json();
console.log(me.email, me.accounts.map((account) => account.name));
```

```json 200
{
  "sid": "usr_2jL4kM6nB8vC1xZ3aS5dF7gH9qW",
  "firstName": "Jordan",
  "lastName": "Lee",
  "email": "jordan@example.com",
  "timezone": "America/New_York",
  "defaultAccountSid": "acc_2mXq7RbT4kPz9WvN3cHd8LsYfQa",
  "defaultBucketSid": "k3m9p2x",
  "defaultEnvironmentSid": "prd7k2",
  "createdAt": "2026-03-02T15:20:11.000Z",
  "emailVerified": true,
  "identities": [
    {
      "sid": "uid_2wE4rT6yU8iO1pA3sD5fG7hJ9kL",
      "provider": "password",
      "email": "jordan@example.com",
      "emailVerified": true,
      "lastLoginAt": "2026-10-19T13:02:44.000Z",
      "createdAt": "2026-03-02T15:20:11.000Z"
    }
  ],
  "mfaEnabled": true,
  "mfaTotpEnabled": true,
  "mfaSmsEnabled": false,
  "mfaPhoneLast4": null,
  "mfaEnrolledAt": "2026-03-02T15:31:40.000Z",
  "accounts": [
    {
      "sid": "acc_2mXq7RbT4kPz9WvN3cHd8LsYfQa",
      "name": "Acme Store",
      "isPrimary": true,
      "role": "owner",
      "createdAt": "2026-03-02T15:20:11.000Z"
    }
  ],
  "chat": { "userHash": null }
}
```

## Verify token

`GET https://api.apitraffic.io/v1/authentication/verify`

Checks that a token is valid and returns the account it belongs to. Works with API tokens, user sessions and OAuth access tokens, so it is a cheap way for a script to confirm its credentials before doing real work.

**Permissions:** any valid token except an `ingest` API token.

### Response

- **accountSid (string, required)**:
  The account the token belongs to.

```bash cURL
curl https://api.apitraffic.io/v1/authentication/verify \
  -H "Authorization: Bearer $APITRAFFIC_TOKEN"
```

```js Node.js
const response = await fetch('https://api.apitraffic.io/v1/authentication/verify', {
  headers: { Authorization: `Bearer ${process.env.APITRAFFIC_TOKEN}` },
});
if (!response.ok) throw new Error(`Token rejected: ${response.status}`);
const { accountSid } = await response.json();
```

```json 200
{
  "accountSid": "acc_2mXq7RbT4kPz9WvN3cHd8LsYfQa"
}
```

## Sign out

`GET https://api.apitraffic.io/v1/authentication/signout`

Ends the session the token belongs to. The token stops working immediately, and the sign-out is recorded in the [account history](https://www.apitraffic.io/docs/account/activity-log).

**Permissions:** a user session. To stop an API token working, [delete it](https://www.apitraffic.io/docs/api-reference/api-tokens#delete-api-token) instead.

### Response

- **successful (boolean, required)**:
  `true` when the session was ended.

```bash cURL
curl https://api.apitraffic.io/v1/authentication/signout \
  -H "Authorization: Bearer $APITRAFFIC_SESSION_TOKEN"
```

```js Node.js
await fetch('https://api.apitraffic.io/v1/authentication/signout', {
  headers: { Authorization: `Bearer ${process.env.APITRAFFIC_SESSION_TOKEN}` },
});
```

```json 200
{
  "successful": true
}
```

## Create embed token

`POST https://api.apitraffic.io/v1/accounts/{accountSid}/embeds/token`

Creates a short-lived, signed token for an [embedded request log](https://www.apitraffic.io/docs/integrations/embed) inside your own application. The bucket and filters are locked into the token, so a viewer can only see the traffic you chose. Call this from your server, never from the browser, and hand only the resulting token to the page. The embed's own read endpoints, authenticated with this token, are described in the [embed guide](https://www.apitraffic.io/docs/integrations/embed#api-reference).

**Plan:** needs a plan that includes **Embeds**. **Permissions:** owner or admin, or an API token with the `administrator` role. Members, `user` tokens and `ingest` tokens are refused with `403` and code `2010`. An embed token reads the account's captured traffic, so keep the token you mint it with on your server.

### Path parameters

- **accountSid (path, string, required)**:
  The account identifier.

### Body parameters

- **bucketSid (body, string, required)**:
  The bucket the embed shows.

- **filters (body, object)**:
  Filters locked into the token: `environmentSid`, `criteria` (the [search syntax](https://www.apitraffic.io/docs/traffic/search); inside a double-quoted value, escape `"` as `\"` and `\` as `\\`) and `streamViewSid`.

- **ttl (body, integer, default 3600)**:
  How long the token is valid, 60 to 86400 seconds.

- **theme (body, string, default light)**:
  `light`, `dark` or `auto`.

- **tabs (body, string[])**:
  The request detail tabs the embed may show: `request`, `response`, `connection`, `waf`, `related`, `workflows`, `tags`, `waterfall`, `traces`, `trace`, `concurrency`, `ai`. Data for a tab you leave out is never returned. Omit for the default set (`request`, `response`, `connection`, `workflows`, `tags`, `traces`, `ai`); send `[]` to hide request detail entirely.

- **features (body, object)**:
  `copyRequest` (offer "Copy request" code, which shows headers and the query string) and `includeBodies` (show request and response bodies). Both default to `false`.

- **view (body, string, default request-log)**:
  The embed view. `request-log` is the only one.

### Response

- **token (string, required)**:
  The signed embed token.

- **expiresAt (string, required)**:
  When it expires (ISO 8601).

- **tabs (string[], required)**:
  The tabs the token allows, after unknown ones are dropped and defaults applied.

- **features (object, required)**:
  The features the token enables.

```bash cURL
curl -X POST https://api.apitraffic.io/v1/accounts/acc_2mXq7RbT4kPz9WvN3cHd8LsYfQa/embeds/token \
  -H "Authorization: Bearer $APITRAFFIC_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "bucketSid": "k3m9p2x",
    "filters": { "environmentSid": "prd7k2", "criteria": "tag:customer == \"cus_1042\"" },
    "ttl": 900
  }'
```

```js Node.js
const accountSid = 'acc_2mXq7RbT4kPz9WvN3cHd8LsYfQa';
const response = await fetch(`https://api.apitraffic.io/v1/accounts/${accountSid}/embeds/token`, {
  method: 'POST',
  headers: {
    Authorization: `Bearer ${process.env.APITRAFFIC_TOKEN}`,
    'Content-Type': 'application/json',
  },
  body: JSON.stringify({
    bucketSid: 'k3m9p2x',
    filters: { environmentSid: 'prd7k2', criteria: 'tag:customer == "cus_1042"' },
    ttl: 900,
  }),
});
const { token, expiresAt } = await response.json();
```

```json 200
{
  "token": "eyJhbGciOiJIUzI1NiJ9.eyJidWNrZXRTaWQiOiJrM205cDJ4In0.c2lnbmF0dXJl",
  "expiresAt": "2026-10-20T13:15:00.000Z",
  "tabs": ["request", "response", "connection", "workflows", "tags", "traces", "ai"],
  "features": { "copyRequest": false, "includeBodies": false }
}
```

## Errors

| Status | Code | Meaning |
| --- | --- | --- |
| `400` | `1000` | A field is invalid, for example a `ttl` under 60 or a `criteria` value with an unescaped quote. |
| `400` | `2006` | The session could not be ended. Try again. |
| `403` | `2221` | The plan does not include embeds. |
| `401` | `2004` | No token was sent. |
| `401` | `2005` | The token is unknown, revoked or expired, or (for **Verify token**) its account could not be found. |
| `403` | `2010` | An `ingest` API token was used, or, for **Create embed token**, the caller is a member or a `user` API token. Mint embed tokens with an `administrator` token. |

## Related

- [API tokens API](https://www.apitraffic.io/docs/api-reference/api-tokens):
    Create and revoke the tokens your scripts use.

- [Sign-in and security](https://www.apitraffic.io/docs/account/security):
    Sign-in methods and multi-factor authentication.