Skip to main content
Register + OTP is the front door: without verifying your phone you won’t receive the apiKey that unlocks the rest of the API.
The Platform API separates account auth from API auth (apiKey).

What is verificationToken?

A short-lived JWT (~15 minutes) returned when a second step is required. It is not the API key.
POST /v1/platform/verify is only for phone OTP after register. TOTP from an authenticator app goes in POST /login, not verify.

Full flow for agents

First account and first workspace

The first workspace is created automatically on phone verification — not on register.

Second workspace

Requires workspace:create (or empty scopes during onboarding).

Login with workspaceId

  • Optional workspaceId: defaults to most recent OWNER workspace.
  • Only workspaces where you are OWNER or ADMIN accept a new key via login.
  • createApiKey: false → only sessionToken.

2FA login

Step A — email + password → requiresSecondFactor + verificationToken. Step B — same endpoint with that token + totpCode (+ optional createApiKey, workspaceId).

Register / verify / login summary

Next: Quick start · Workspaces