Sign in as a creator - Membership.io Docs

A platform user is a creator or administrator who signs in to manage teams, hubs, media, and API keys. Use app.member.dev for the admin, or use a platform access token to call the API from your own tool. A team API key is for server-to-server work and cannot change a user’s password. See Authentication for the credential types. To sign up or sign in through the admin at app.member.dev instead, see Getting started in the admin. For the API examples, set the base URL first:

export MIO_BASE_URL="https://api.member.dev"

In the admin: open Sign in, enter your email and password, and select Sign in. If you do not have an account, select Create an account. With the API: send a flat JSON body. The response contains an access token and a refresh token. Keep both private; send the access token as a bearer credential on admin requests.

TOKEN_RESPONSE=$(
  curl -sS -f -X POST "$MIO_BASE_URL/api/v1/auth/login" \
    -H "Content-Type: application/vnd.api+json" \
    -H "Accept: application/vnd.api+json" \
    -d '{"email":"admin@example.com","password":"example-password"}'
)
export MIO_ACCESS_TOKEN="$(printf '%s' "$TOKEN_RESPONSE" | jq -r '.access_token')"
export MIO_REFRESH_TOKEN="$(printf '%s' "$TOKEN_RESPONSE" | jq -r '.refresh_token')"

Reference: Login

Forgot your password

In the admin: select Forgot password? on Sign in. On the Forgot your password? page, enter the email you sign in with and select Send reset link. The confirmation is the same for every email address: it does not reveal whether an account exists. The link works once and expires after one hour. Too many requests show an inline error; you can request up to five links per hour from one IP address.

During alpha, the API can return success without sending an email when the account’s team owns no hub. The admin tells everyone about this limitation on the confirmation screen. If you have no hub and are locked out, contact support. This is tracked in MIO-4236.

With the API: this is a public request; it needs no bearer token. A valid request returns 202 Accepted with an empty body, even when the email is unknown. A malformed email returns 422; exceeding the limit returns 429.

curl -i -sS -X POST "$MIO_BASE_URL/api/v1/auth/forgot" \
  -H "Content-Type: application/vnd.api+json" \
  -H "Accept: application/vnd.api+json" \
  -d '{"email":"admin@example.com"}'

Reference: Forgot Password

Reset your password

In the admin: open the emailed link. It goes to https://app.member.dev/reset-password#<token>. The token is after #, in the URL fragment; the page removes it from the address bar after opening. On Choose a new password, enter a password of at least eight characters, confirm it, and select Reset password. If the link has expired or was already used, select Request a new link. A password validation error leaves the link valid so you can correct the password and retry. After success, all existing sessions are signed out; select Sign in and use the new password. The reset itself does not sign you in. With the API: copy only the token after # from the emailed link. Send it with the new password in a flat body. Success is 204 No Content. An unknown, expired, or used token returns 410 with code password_reset_expired; a short password returns 422 with a pointer to /password and leaves the token available for a retry. Too many attempts return 429. Requesting another link does not cancel an earlier one. Redeeming any one of them expires the rest.

export MIO_RESET_TOKEN="<token after # in the emailed link>"
curl -i -sS -X POST "$MIO_BASE_URL/api/v1/auth/reset" \
  -H "Content-Type: application/vnd.api+json" \
  -H "Accept: application/vnd.api+json" \
  -d "$(jq -n --arg token "$MIO_RESET_TOKEN" --arg password 'a-new-password' \
    '{token: $token, password: $password}')"

API errors use a JSON:API errors array. For example, an expired link returns an error with status: "410" and code: "password_reset_expired"; validation errors identify the field with source.pointer. See Error handling. From the CLI, use mio auth forgot-password --email <addr>, then mio auth reset-password --token '<the emailed link>', and then mio login. The reset command prompts for the new password or reads MIO_PASSWORD; it sends no API key. See Forgot your password?. These commands land in the mio release after v0.24.0. Reference: Reset Password

Change a password while signed in

In the admin: open Account in the sidebar, then the Password section. Enter Current password, New password (at least eight characters), and Confirm new password. Select Change password. The admin shows Password changed and signs out your other sessions. If you no longer know the current password, select Reset via email instead. See Your account and team. With the API: send your platform access token and a flat body. A successful 200 response is a fresh TokenResponse with access_token, refresh_token, expires_in, and token_type. Replace your stored tokens with the new pair; older refresh tokens stop working. In the admin browser, the refresh token is rotated in an HttpOnly cookie. Older access tokens expire on their normal short schedule.

CHANGE_RESPONSE=$(
  curl -sS -f -X POST "$MIO_BASE_URL/api/v1/auth/me/password/change" \
    -H "Authorization: Bearer $MIO_ACCESS_TOKEN" \
    -H "Content-Type: application/vnd.api+json" \
    -H "Accept: application/vnd.api+json" \
    -d '{"current_password":"example-password","new_password":"a-new-password"}'
)
export MIO_ACCESS_TOKEN="$(printf '%s' "$CHANGE_RESPONSE" | jq -r '.access_token')"
export MIO_REFRESH_TOKEN="$(printf '%s' "$CHANGE_RESPONSE" | jq -r '.refresh_token')"

A wrong current password returns 422 with code incorrect_password. An invalid new password returns 422 with a pointer to /new_password. A missing or invalid access token returns 401; a team API key returns 403; too many attempts return 429. Reference: Change Password

Call an admin endpoint

For example, get your own user record, then list the teams you belong to:

curl -sS "$MIO_BASE_URL/api/v1/auth/me" \
  -H "Authorization: Bearer $MIO_ACCESS_TOKEN" \
  -H "Accept: application/vnd.api+json" | jq

curl -sS "$MIO_BASE_URL/api/v1/teams" \
  -H "Authorization: Bearer $MIO_ACCESS_TOKEN" \
  -H "Accept: application/vnd.api+json" | jq

Most creator-side work happens under a team. For example, list its hubs with the team’s id in the path:

export TEAM_ID="<team id from the teams list>"
curl -sS "$MIO_BASE_URL/api/v1/teams/$TEAM_ID/hubs" \
  -H "Authorization: Bearer $MIO_ACCESS_TOKEN" \
  -H "Accept: application/vnd.api+json" | jq

Use team API keys for unattended server jobs. They do not replace a platform user’s sign-in or password recovery.

​Sign in

​Forgot your password

​Reset your password

​Change a password while signed in

​Call an admin endpoint

Sign in

Forgot your password

Reset your password

Change a password while signed in

Call an admin endpoint