FryllStart a workspace
↑↓to move↵to openescto close
Docs

Authentication

Most of the API works with a session: sign in once, then send the access token with every request. Posting with a conversation token needs none of this.

Sign in

Send an email and password to POST /auth/login. You get back an access_token and the signed-in user.

Terminal
curl -X POST https://api.fryll.com/auth/login \
  -H "Content-Type: application/json" \
  -d '{"email": "emma@example.com", "password": "'"$FRYLL_PASSWORD"'"}'

A session lasts until you sign out, unless the response gives it an expires_at.

Send the token

Put the token in the Authorization header of every request.

Terminal
curl https://api.fryll.com/users/me \
  -H "Authorization: Bearer $FRYLL_ACCESS_TOKEN"

Workspaces

Channels, messages and members live in a workspace. For those endpoints, also send the workspace’s ID in X-Workspace-Id; each endpoint’s page says whether it needs it. GET /workspaces lists the ones you belong to.

Terminal
curl https://api.fryll.com/channels \
  -H "Authorization: Bearer $FRYLL_ACCESS_TOKEN" \
  -H "X-Workspace-Id: $FRYLL_WORKSPACE_ID"

Sign out

POST /auth/logout ends the session; its token stops working straight away.

Treat an access token like a password: it can do anything you can. Keep it out of your code and your logs.