Auth (signup & sessions)

Most developers only need an API key from the dashboard. These endpoints are for building your own sign-in flow, or for automation.

#POST /auth/signup · public

Create a free account and receive a session and a first API key.

curl -X POST -H "Content-Type: application/json" \
  -d '{"email": "you@example.com", "password": "at-least-8-chars"}' \
  "https://api.pakdatahub.com/auth/signup"

{ "success": true, "plan": "free", "session_token": "…", "api_key": "pk_live_…",
  "note": "store this key now — it is shown only once" }

The key is also emailed to you.

#POST /auth/login · public

Body { "email", "password" } returns { "success": true, "session_token": "…" }. Wrong credentials return 401.

#POST /auth/logout

Body { "session_token": "…" } invalidates the session.

#POST /auth/change-password 🔑 / session

Body { "current_password", "new_password" }. A wrong current password returns 401; a new password under 8 characters returns 422.

#POST /auth/set-password · public

For buyers who paid before creating a password. Body { "token", "password" }, where the token is the one-time signup token from the post-checkout /welcome?token= redirect. It only works while the account has no password yet (otherwise 409), and it returns a session.

#Google sign-in · public

• GET /auth/google/config returns { "enabled": true }.
• GET /auth/google/start redirects to Google's consent screen.
• GET /auth/google/callback signs you in by verified Google email (creating the account if needed) and redirects to https://pakdatahub.com/auth/callback#session=<token>.

#Using a session token

Send X-Session-Token: <token> to the account endpoints: /v1/account, /v1/keys, /v1/usage, /v1/webhooks and /v1/billing/portal. Sessions last 30 days. Data endpoints need an API key.