Authentication

The Sesharo API authenticates requests with a bearer token in the Authorization header. You obtain a token by logging in.

Get a token

POST /auth/login
Content-Type: application/json

{ "email": "[email protected]", "password": "your-password" }

On success you receive an API token:

{ "api_token": "…" }

Send that token on every authenticated request:

Authorization: Bearer <api_token>

If two-factor authentication is enabled

When your account has TOTP enabled, POST /auth/login does not return a token directly. Instead it returns a short-lived pending token:

{ "totp_required": true, "pending_token": "…" }

Complete the login by exchanging that pending token plus your current authenticator code:

POST /auth/totp/verify
Content-Type: application/json

{ "pending_token": "…", "code": "123456" }

which returns { "api_token": "…" }.

Personal access tokens

For long-lived programmatic access, the API supports personal access tokens (see the /auth/tokens endpoints in the API Reference). Prefer these for scripts and integrations rather than reusing a session token.

Read-only access for AI agents (MCP)

Sesharo also exposes a read-only OAuth 2.1 endpoint designed for AI assistants and agents (the Model Context Protocol server). It uses the standard authorization-code + PKCE flow and never requires you to paste a token. This is the right path if you’re wiring Sesharo into an assistant rather than writing a traditional API client.

Trying requests from this site

The API’s OpenAPI document doesn’t declare a security scheme, so the reference’s “Try it” panel won’t attach your token automatically. Add the header yourself — Authorization: Bearer <api_token> — when experimenting.