Authentication & sessions

Current release · Updated October 2, 2026

DryKraft authentication & sessions API: methods, permissions, request fields, response shapes, examples and current limits. Read authentication and error handling first.

GET/api/health

Check service health

Access: Public · Success: 200

Checks PostgreSQL and Redis connectivity.

No request body is required.

Response

Field	Type	Required
`status`	ok	No
`database`	connected	No
`redis`	connected	No

Request shape (illustrative)

curl --request GET \
  --url 'https://app.drykraft.com/api/health'

GET/api/meta

Read public configuration

Access: Public · Success: 200

Supported currencies include their code, name, symbol and decimal precision. Demo is false in production.

No request body is required.

Response

Field	Type	Required	Details
`name`	string	No	DryKraft
`domain`	string	No	Workspace domain
`currency_options`	object[]	No
`demo`	boolean	No	Local sample enabled

Request shape (illustrative)

curl --request GET \
  --url 'https://app.drykraft.com/api/meta'

GET/api/auth/subdomain

Check workspace address

Access: Public · Success: 200

Reserved and occupied names are unavailable. This does not reserve an address.

Query parameters

Parameter	Type	Required	Details
`slug`	string	Yes	Required; 3-40 characters. Pattern: `^[a-z][a-z0-9-]{2,39}$`.

No request body is required.

Response

Field	Type	Required	Details
`available`	boolean	No	Availability

Request shape (illustrative)

curl --request GET \
  --url 'https://app.drykraft.com/api/auth/subdomain?slug=example-company'

POST/api/auth/signup

Create account

Access: Public · Success: 201

Use the central application address, not a workspace host. Sets the session cookie; workspace setup follows.

JSON request

Field	Type	Required	Details
`name`	string	Yes	Name Max 100 characters.
`email`	email	Yes	Max 200 characters.
`password`	string	Yes	Max 128 characters.

Response

Field	Type	Required	Details
`id`	uuid	No
`onboarding`	true	No

Request shape (illustrative)

curl --request POST \
  --url 'https://app.drykraft.com/api/auth/signup' \
  --header 'Content-Type: application/json' \
  --data '{
  "name": "<Name>",
  "email": "person@example.com",
  "password": "<value>"
}'

POST/api/auth/onboarding

Create first workspace

Access: Account session · Success: 201

Central application only. Retries reuse the account’s first completed workspace. Starts the 15-day trial.

JSON request

Field	Type	Required	Details
`workspace`	string	Yes	Company name Max 100 characters.
`slug`	string	Yes	Pattern: `^[a-z][a-z0-9-]{2,39}$`.
`currency`	string	No	Supported currency code, e.g. USD, INR, EUR or KWD. Default USD.
`currencies`	string[]	No	Min 1 items. Max 180 items.

Response

Field	Type	Required	Details
`id`	uuid	No

Request shape (illustrative)

curl --request POST \
  --url 'https://app.drykraft.com/api/auth/onboarding' \
  --cookie 'drykraft_session=<YOUR_SESSION_TOKEN>' \
  --header 'Content-Type: application/json' \
  --data '{
  "workspace": "Example Company",
  "slug": "example-company",
  "currency": "USD",
  "currencies": [
    "USD",
    "INR",
    "EUR",
    "KWD"
  ]
}'

POST/api/auth/login

Sign in

Access: Public · Success: 200

Sets a seven-day session cookie. On a workspace hostname membership is required.

JSON request

Field	Type	Required	Details
`email`	email	Yes	Max 200 characters.
`password`	string	Yes	Max 128 characters.

Response

Use OK.

Request shape (illustrative)

curl --request POST \
  --url 'https://app.drykraft.com/api/auth/login' \
  --header 'Content-Type: application/json' \
  --data '{
  "email": "person@example.com",
  "password": "<value>"
}'

POST/api/auth/demo

Open local sample

Access: Public · Success: 200

Local development only when enabled; production returns 404.

No request body is required.

Response

Use OK.

Request shape (illustrative)

curl --request POST \
  --url 'https://app.drykraft.com/api/auth/demo'

POST/api/auth/logout

Sign out

Access: Public · Success: 200

Revokes this cookie session and clears the cookie. Safe when already signed out.

No request body is required.

Response

Use OK.

Request shape (illustrative)

curl --request POST \
  --url 'https://app.drykraft.com/api/auth/logout'

GET/api/session

Read account and workspace

Access: Account session · Success: 200

Returns accessible workspaces, selected workspace/role, public user and supported currencies. Before onboarding workspace and role are null.

No request body is required.

Response

Field	Type	Required	Details
`user`	object	No
`workspace`	object or null	No
`role`	string or null	No
`workspaces`	object[]	No
`currency_options`	object[]	No
`domain`	string	No	Domain
`subdomain_routing`	boolean	No	Wildcard routing enabled

Request shape (illustrative)

curl --request GET \
  --url 'https://app.drykraft.com/api/session' \
  --cookie 'drykraft_session=<YOUR_SESSION_TOKEN>'

POST/api/session/workspace

Switch workspace

Access: Workspace member · Success: 200

Membership is checked. Workspace hostname restrictions still apply to subsequent requests.

JSON request

Field	Type	Required	Details
`id`	uuid	Yes

Response

Use OK.

Request shape (illustrative)

curl --request POST \
  --url 'https://app.drykraft.com/api/session/workspace' \
  --cookie 'drykraft_session=<YOUR_SESSION_TOKEN>' \
  --header 'Content-Type: application/json' \
  --data '{
  "id": "00000000-0000-4000-8000-000000000001"
}'