Authenticating

There is no password. You prove an address, and the address is the account. Two calls, and the second is the only place a token comes from.

The two calls

POST/auth/send-codeBody { email }. Puts six digits in the inbox. Answers the same for an address that exists and one that does not.

POST/auth/verify-codeBody { email, code, mode }. Returns { token, user }.

DELETE/auth/logoutRetires this session. DELETE, not POST: POST is a 404.

DELETE/auth/logout-allRetires every session on the account.

mode is enforced, not a hint

mode is login or register, and the server applies it: signing in with an address nobody registered is refused rather than quietly turned into a sign-up. Sending the wrong one is a real error, not a preference.

Using the token

Every route of every API chapter lives at https://api.vibetron.ai: /trons is https://api.vibetron.ai/trons, /v1/jobs/:jobId is https://api.vibetron.ai/v1/jobs/:jobId. Authorization: Bearer <token>, on every route except /auth/*, /plans, /mcp-registry and /public/*. Those are public (the last is the public API and MCP). The /v1 routes take a Tron API key instead of a session (see The Tron API).

Sessions

A token from /auth/verify-code lives 30 days. It is a row on the server as well as a signed token: DELETE /auth/logout removes this session and DELETE /auth/logout-all every session of the account, and either takes effect at once, before the expiry.