Backend

People & auth

People who use the app you ship sign in through Crafio Auth. They are not Crafio operators.

Do not mix the two systems

Team (Clerk + workspace members) uses the Crafio admin.
People (tenant users) use only the customer app.

Do not stand up Clerk or NextAuth in the customer app unless the owner asks.

Identities

The owner chooses identities on the People page: email, username, or both. Password always works with whichever identities are enabled. Magic links require email.

MCP

Call auth.configure first. Create users with auth.create_user using the fields that configure requires. List them with auth.users.

REST

Send the publishable key as Bearer. After sign-in, send the session token as X-Crafio-User.

POST /v1/<projectId>/auth/sign-up
{ "email"?: string, "username"?: string, "name"?: string, "password"?: string }
409 if that email or username is already on this project. Sign in instead.

POST /v1/<projectId>/auth/sign-in
{ "identifier" | "email" | "username", "password" }

GET /v1/<projectId>/auth/me

Magic links

Email identity must be on. Two calls: start, then consume.

POST /v1/<projectId>/auth/magic
{ "email": "[email protected]" }
→ { "ok": true }          production
→ { "ok": true, "devToken": "crafio_magic_…" }   non-production only

POST /v1/<projectId>/auth/magic
{ "token": "crafio_magic_…" }
→ { "user", "session" }

Crafio stores a hash of the token for 15 minutes. You send the link from your app (or a connected email provider). devToken is never returned in production.