Sign up
Creates a user, their personal organization on the Free plan with a first project and API key, and logs in (cookie bx_session). Needs acceptTerms: true (400 terms_not_accepted otherwise); the acceptance is recorded with the terms version. With inviteToken (from an invitation link; the email must be the invited one) the invitation is accepted too and the login starts in that organization. Where mail is delivered, signup also emails a 6-digit confirmation code, and the new account is held back until it enters it (POST /v1/auth/confirm-email; see emailConfirmationRequired in /v1/auth/me); signing in later never asks for a code.
POST
/v1/auth/signupRequest
| Method and path | POST/v1/auth/signup |
|---|---|
| Base URL | https://api.boxline.dev |
| Authentication | None. Anyone can call it. |
| Rate limit | Yes. See Rate limits for the numbers and headers. |
Body
JSON with content-type: application/json. Required.
| Name | Type | Default | Allowed values | Description |
|---|---|---|---|---|
emailrequired | string | – | – | Format: email. |
passwordrequired | string | – | – | At least 8 characters. |
name | string | null | – | – | Optional; trimmed, no control characters. Blank = none. Up to 100 characters. |
acceptTermsrequired | boolean | – | true | The user accepts the terms of service and acceptable use policy (400 terms_not_accepted otherwise). |
inviteToken | string | – | – | The token of an invitation link (#token=…). The email must be the invited one (403 invite_email_mismatch); 404 invite_not_found, 410 invite_expired, invite_withdrawn, invite_used. Nothing is created when it fails. |
curl -X POST "https://api.boxline.dev/v1/auth/signup" \ -H "content-type: application/json" \ -d '{ "email": "ada@example.com", "password": "correct-horse-battery", "name": "Ada Lovelace", "acceptTerms": true }'import { Boxline } from "@boxline/sdk";const bx = new Boxline(); // reads BOXLINE_API_KEY and BOXLINE_API_URLconst { apiKey } = await bx.auth.signup({ email: "ada@example.com", password: "correct-horse-battery", name: "Ada Lovelace", acceptTerms: true,});from boxline import Boxlinebx = Boxline() # reads BOXLINE_API_KEY and BOXLINE_API_URLcreated = bx.auth.signup("ada@example.com", "correct-horse-battery", name="Ada Lovelace", accept_terms=True)print(created["apiKey"])Responses
201 Created
Account created. The API key is shown only here.
Headers
Set-Cookie:bx_session: HttpOnly, SameSite=Lax, Path=/ (and Secure on https).RateLimit-Limit: Requests allowed in the current window of this route's limit. (Rate limits)RateLimit-Remaining: Requests left in the current window. (Rate limits)RateLimit-Reset: Seconds until the window starts again. (Rate limits)
Fields
| Name | Type | Default | Allowed values | Description |
|---|---|---|---|---|
user | object | – | – | |
user.id | string | – | – | |
user.email | string | – | – | Format: email. |
user.name | string | null | – | – | The user's name (signup |
organization | object | – | – | |
organization.id | string | – | – | |
organization.name | string | – | – | |
organization.plan | string | – | – | |
organization.personal | boolean | – | – | The user's personal organization (made at signup). |
organization.suspended | object | null | – | – | |
organization.suspended.at | string | – | – | Format: date-time. |
organization.suspended.reason | string | null | – | – | |
organization.role | string | null | – | owner, admin, developer, viewer, billing | The caller's role (null with an API key). |
project | object | – | – | |
project.id | string | – | – | |
project.name | string | – | – | |
project.plan | string | – | – | The project's organization's plan. |
project.orgId | string | – | – | |
project.concurrencyCap | integer | null | – | – | The project's own limit on running sessions, below the organization's (null: none). |
project.suspended | object | null | – | – | |
project.suspended.at | string | – | – | Format: date-time. |
project.suspended.reason | string | null | – | – | |
apiKey | string | – | – | The first API key (shown once). |
invite | object | null | – | – | The invitation accepted with inviteToken (the console login starts in that organization), or null. |
invite.organization | object | – | – | |
invite.organization.id | string | – | – | |
invite.organization.name | string | – | – | |
invite.role | string | – | owner, admin, developer, viewer, billing |
{ "user": { "id": "usr_Q2x9L0aPz7NmK3Jb", "email": "ada@example.com", "name": "Work account" }, "organization": { "id": "org_Hk2Lq8Zx0Vb5Nm1C", "name": "Work account", "plan": "free", "personal": false, "suspended": { "at": "2026-09-29T10:00:00.000Z", "reason": "…" }, "role": "owner" }, "project": { "id": "prj_Hk2Lq8Zx0Vb5Nm1C", "name": "Work account", "plan": "free", "orgId": "org_Hk2Lq8Zx0Vb5Nm1C", "concurrencyCap": 0, "suspended": { "at": "2026-09-29T10:00:00.000Z", "reason": "…" } }, "apiKey": "bxl_…", "invite": { "organization": { "id": "…", "name": "Work account" }, "role": "owner" }}Errors
Errors have a matching HTTP status and the same body. code is stable, so check it in your code; message is for people. See Errors and request ids.
| Status | Codes | When |
|---|---|---|
| 400 Bad Request | invalid_request, invalid_json, invalid_cursor, invalid_idempotency_key, invalid_extension, variables_with_extensions, terms_not_accepted, invalid_reset_token, invalid_confirmation_code, wrong_password, no_password, invalid_next, invalid_oauth_token | The request is not valid. |
| 409 Conflict | session_not_running, shell_disabled, browser_disabled, nothing_saved, not_resumable, invalid_state, conflict, email_taken, identity_in_use, provider_already_linked, last_sign_in_method, not_impersonating, machine_too_old, too_many_credential_values, limit_reached, terms_version_mismatch, no_project, last_owner, organization_not_empty, project_has_sessions, already_member, invite_pending, idempotency_in_progress | The current state does not allow it, or a request with this Idempotency-Key is still being answered. |
| 429 Too Many Requests | rate_limited, concurrency_limit | Too many requests, or the organization's concurrent sessions (its plan's) or the project's concurrencyCap are in use. |
{ "error": { "code": "not_found", "message": "session not found", "requestId": "req_4fJx0aQm2Lk9Pz7N" }}Learn more
These docs describe a beta API. Endpoints, fields and SDK methods may change before general availability; breaking changes will be listed in the changelog.