API Reference

Auth API (portal session)

Developer-portal session endpoints.These routes are not part of the customer API-key surface. The authenticated portal routes — GET/PATCH/DELETE /auth/me, POST /auth/logout, GET /auth/sessions, and POST /auth/logout-all — are gated by the portal JWT (Depends(require_developer_jwt)) and return 401 when called with a bearer API key. The sign-in entry points (POST /auth/google, POST /auth/magic-link/request, POST /auth/magic-link/verify) and the rotation route (POST /auth/refresh) do not require a JWT — they're how you obtain or rotate one — and they ignore API keys entirely. The retired POST /auth/register and POST /auth/login routes return 410 Gone.Obtain a JWT by signing into the developer portal via Google SSO or email magic-link; the portal stores it in an HttpOnly cookie and proxies requests through portal/api/[[...path]].The Python SDK exposes DeveloperClient.get_me/update_me/delete_me/logout wrappers for the JWT-gated routes; those wrappers require a portal JWT and will not work with an AethexAI API key. We document the routes here for awareness; if you only have an API key, skip this page.

Base URL: https://api.aethexai.com/api/v1
Endpoints: 6

GET/auth/me

Read the signed-in developer's profile. Portal JWT only.

Get current developer profile

Returns the profile of the developer whose portal JWT authorizes the request. Not callable with a customer API key — returns 401 against an X-API-Key header.

Errors

401Unauthorized

Missing or invalid portal JWT. API keys are not accepted on these routes.

Sign into the developer portal via Google SSO or email magic-link and let the portal proxy these calls for you.

Request

json

curl -X GET https://api.aethexai.com/api/v1/auth/me \
  -H "Authorization: Bearer <portal_jwt>"

200 Response

json

{
  "id": "developer-uuid",
  "email": "[email protected]",
  "name": "Jane Developer",
  "company": "Example Co"
}

PATCH/auth/me

Patch `name` and/or `company` on the signed-in developer. Portal JWT only.

Update current developer profile

Patches name and/or company on the signed-in developer's row. Either field may be omitted. Not callable with a customer API key.

Request body

namestringoptional
New display name. Trimmed; pass null or omit to leave unchanged.
companystringoptional
New company name. Trimmed; pass null or omit to leave unchanged.

Errors

401Unauthorized

Missing or invalid portal JWT. API keys are not accepted on these routes.

Sign into the developer portal via Google SSO or email magic-link and let the portal proxy these calls for you.

Request

json

curl -X PATCH https://api.aethexai.com/api/v1/auth/me \
  -H "Authorization: Bearer <portal_jwt>" \
  -H "Content-Type: application/json" \
  -d '{"name": "Jane D.", "company": "Example Co"}'

200 Response

json

{
  "id": "developer-uuid",
  "email": "[email protected]",
  "name": "Jane D.",
  "company": "Example Co"
}

DELETE/auth/me

Soft-delete the signed-in developer and deactivate all their API keys. Portal JWT only.

Delete current developer account

Soft-deletes the signed-in developer's row and deactivates every API key on their tenant. The response clears session cookies. Not callable with a customer API key.

Errors

401Unauthorized

Missing or invalid portal JWT. API keys are not accepted on these routes.

Sign into the developer portal via Google SSO or email magic-link and let the portal proxy these calls for you.

POST/auth/logout

Revoke the JWT session backing the current cookie/header. Portal JWT only.

Logout the current portal session

Revokes the server-side session row corresponding to the caller's JWT and clears the portal cookies. Use this from the portal sign-out button. Not callable with a customer API key.

Errors

401Unauthorized

Missing or invalid portal JWT. API keys are not accepted on these routes.

Sign into the developer portal via Google SSO or email magic-link and let the portal proxy these calls for you.

GET/auth/sessions

List the developer's active server-side JWT sessions. Portal JWT only.

List active portal sessions

Returns the active server-side sessions for the signed-in developer — the per-row state the portal's "where you are signed in" page renders. The session backing the caller's own JWT has is_current: true so the UI can label it and gate the per-row revoke action. Not callable with a customer API key.Forensic fields (created_ip, last_activity_ip, user_agent) are best-effort and may be null for sessions adopted from pre-rollout tokens.

Errors

401Unauthorized

Missing or invalid portal JWT. API keys are not accepted on these routes.

Sign into the developer portal via Google SSO or email magic-link and let the portal proxy these calls for you.

Request

json

curl -X GET https://api.aethexai.com/api/v1/auth/sessions \
  -H "Authorization: Bearer <portal_jwt>"

200 Response

json

{
  "sessions": [
    {
      "id": "a1b2c3d4e5f6",
      "created_at": "2026-05-20T14:32:11Z",
      "last_activity_at": "2026-05-26T09:15:04Z",
      "idle_expires_at": "2026-05-28T09:15:04Z",
      "absolute_expires_at": "2026-06-19T14:32:11Z",
      "created_ip": "203.0.113.7",
      "last_activity_ip": "203.0.113.7",
      "user_agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 13_5) AppleWebKit/605.1.15",
      "is_current": true
    }
  ]
}

POST/auth/logout-all

Revoke every active session for the signed-in developer. Portal JWT only.

Logout all portal sessions

Revokes every active server-side session for the signed-in developer — the "sign out everywhere" recovery path. Includes the caller's own session, so the response clears the portal cookies. Per-developer rate-limited so a stolen access token cannot burn the legitimate user's recovery path. revoked_count reflects how many session rows were revoked by this call. Not callable with a customer API key.

Errors

401Unauthorized

Missing or invalid portal JWT. API keys are not accepted on these routes.

Sign into the developer portal via Google SSO or email magic-link and let the portal proxy these calls for you.