Authentication
Login, logout, and API key management
Login to the system
Authenticate an organization with its email and password and receive a JWT bearer token. The token is opaque and carries only the organization id — read tenant identity from GET /organization/me, not from the token payload.
Logout from the system
Logout from the system
Get API keys
List all API keys attached to this account.
Create API Key
Create a new random API key.
Get signing keys
List all request-signing public keys attached to this account, including revoked ones.
Register signing key
Register an Ed25519 public key for signed-request authentication. The signature field must be a base64 Ed25519 signature over the exact UTF-8 bytes of the publicKey field, made with the corresponding private key (proof of possession). Once registered, requests can authenticate by sending X-Signature-Key-Id, X-Signature-Timestamp (unix seconds), X-Signature-Nonce, and X-Signature (base64) headers instead of a bearer token. The signature covers the string: 'magfi-v1 {METHOD} {path with query} {timestamp} {nonce} {sha256 hex of raw body, empty body allowed}'.
Revoke signing key
Revoke a signing key by ID. Revoked keys are rejected immediately on signed requests.
Delete API Key
Delete an API key by ID.