Skip to main content

Sign in a demo persona and obtain an access token

POST 
/api/auth/token

Exchanges a persona id and that persona's password for a Keycloak access token using the password grant. Only the demo personas can be signed in here; any other userId is rejected with 400. The server holds no password. On success the response sets the startupos_session cookie (HttpOnly, SameSite=Lax, path /api/auth, Secure in production).

Request​

Responses​

Signed in.

Response Headers
    Set-Cookie

    The startupos_session refresh-token cookie. Cleared instead if Keycloak issued no refresh token.