Authentication

Sign in once, then send a bearer token with every call.

The API uses the same sign-in as the app. You sign in with your email and password, receive a session token, and send it as a bearer token.

​

1. Sign in

curl -s "$CADENCE_URL/api/auth/sign-in/email" \
  -H "Content-Type: application/json" \
  -d '{"email": "[e-mail]", "password": "YOUR_PASSWORD"}'

The response includes a token field. That value is your bearer token.

{
  "redirect": false,
  "token": "SIGNED_SESSION_TOKEN",
  "user": { "id": "...", "email": "[e-mail]", "name": "..." }
}

A token is a full sign-in to your account. Keep it in a secret store, never in code or chat logs, and never share it.

​

2. Send it with each call

curl -s "$CADENCE_URL/rpc/me" \
  -H "Authorization: Bearer $CADENCE_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{}'

me returns your account (userId, email, name) and the spaceId the call acted in. It is a good first call to check that the token works.

The token must be the signed value returned by sign-in. An unsigned session id is refused.

​

3. Sign out

Signing out ends the session, and the token stops working:

curl -s -X POST "$CADENCE_URL/api/auth/sign-out" \
  -H "Authorization: Bearer $CADENCE_TOKEN"

​

Accounts without a password

If you sign in with single sign-on or an emailed code, the email and password route above is not available to you. Use an account that has a password for scripted access.

​

What a token can do

A token acts as you, in the space you choose with the x-cadenceplus-space-id header (or your default space). It can do exactly what you can do in the app, and nothing more:

• Members see the bots shared with them and their own settings.
• Owners and admins can also manage people and space settings.
• Nothing in the API grants server administration. Self-hosters change server settings in the server’s environment, not through the API.

​

Handling 401

A 401 with code UNAUTHORIZED means the token is missing, expired, signed out, or you were removed from the space. Sign in again to get a new token. See Errors.