users
Base path: /api/v1/users
The users module is the identity and access layer. It surfaces signup, login, password reset, email verification, Google OAuth, team membership, profile, and API-key management. The auth dependencies that every other module uses (current_user, require_permission, require_company_admin) live in app/modules/users/deps.py. Resources include accounts, sessions, team memberships, invites, OAuth grants, and API keys. Schemas live in app/modules/users/schemas.py.
What you can do with the users API
- Sign up a new account and bootstrap a workspace
- Log in with email/password or Google OAuth
- Verify email and reset forgotten passwords
- Invite teammates and manage their roles
- Mint, list, and revoke first-party API keys (
tnx_<prefix>_<secret>) - Update your profile, avatar, and notification preferences
Common operations
- Log in and receive a JWT for browser sessions
- Mint an API key for server-to-server use
- Revoke a leaked or rotated API key
- Invite a teammate and assign a role
- Remove a teammate when they leave
- Trigger a password reset email
Authentication & scoping
JWTs from login or API keys (Authorization: Bearer tnx_...) both work. Profile and API-key endpoints are user-scoped; team management is workspace-admin-scoped.
Pagination & filtering
Team and key list endpoints paginate cursor-style. See Pagination.
How users authentication works in practice
For a web client, log in once and use the JWT. For server-to-server, mint an API key in the UI or via this module’s mint endpoint, store it as tnx_<prefix>_<secret>, and pass it as Authorization: Bearer tnx_... on every request. Both credentials work on every endpoint.
Where to find per-endpoint detail
The full per-endpoint reference is hand-maintained in v1. Until the auto-Reference pipeline ships (see TECH_DEBTS #15 ), the live OpenAPI spec at https://api.10ex.ai/openapi.json is the source of truth.
MCP equivalents
whoami()
list_api_keys()
mint_api_key({ name: "production-server" })
Related
- Authentication for the credential flow
- API keys for self-service mint and revoke
- Concepts: Roles and permissions