Auth API · appIdentity

A signed-in person asks the organization an app's account is bound to to admit them

POST /api/auth/apps/{appId}/join-requests

A signed-in person asks the organization an app's account is bound to to admit them: they opened the app from inside its system (claim and the app's fresh presence, verified exactly as POST /api/auth/apps/{appId}/claim verifies them), and are not that organization's member.

The organization's owners and admins are told by mail who asked and from which account, and admit them by inviting them, as membership always works — nothing is granted here. The claim's app user must be linked to the signed-in person (403 JoinRequestNotYours otherwise: a session never asks in another person's name). 409 JoinRequestNotNeeded for a claim whose account is bound to no organization (the person places it themselves) or a person who is already its member. Appends auth.join-requested on the organization's trail, and per owner or admin auth.join-request-mail-claimed before their mail is sent (a retry or a second sender leaves one in flight alone), then auth.join-request-mailed once the provider accepts it or auth.join-request-mail-failed, and auth.join-request-notified only once every one is mailed (notified); a failed or stranded one is sent again by asking again and by auth's own sweep. Idempotent by state: a person asks an organization once, and a repeat answers the request already made, appending nothing and mailing nobody once its owners have been told.

Access

Requires a signed-in session: The person's BetterAuth session, and a claim that verifies against the key of the app named in the path

How scopes come from roles: Scopes and roles. Getting a token: Authentication and app tokens.

Retries

Idempotent by state: a person asks an organization once, and a repeat answers the request already made, appending nothing and mailing nobody once its owners have been told.

Why every write carries a key: Idempotency and retries.

Facts appended

auth.join-requested
auth.join-request-mail-claimed
auth.join-request-mailed
auth.join-request-mail-failed
auth.join-request-notified

What a fact is: Facts and the journal.

AI agent tool

No agent tool. Asks an organization to admit the person an app's signed identity claim vouches for — a claim and presence only their browser in the app's own frame holds; never an agent's.

Connecting an agent: AI agents.

Example

curl

curl -X POST 'https://auth.getmanifold.io/api/auth/apps/app_5bd0f3a8-2c4e-4a71-9e6b-0d3f1c2a7e40/join-requests' \
  -H "Authorization: Bearer $MANIFOLD_TOKEN" \
  -H 'Content-Type: application/json' \
  -d '{
  "claim": "eyJhbGciOiJIUzI1NiJ9.eyJhcHBJZCI6ImFwcF81YmQwZjNhOCIsImV4dGVybmFsVXNlcklkIjoiODgxMjA0In0.dm91Y2hlZC1ieS10aGUtYXBw",
  "presence": "eyJhbGciOiJIUzI1NiJ9.eyJleHRlcm5hbFVzZXJJZCI6Ijg4MTIwNCIsImF0IjoxNzkyNjI1MjAwfQ.cHJlc2VudC1ub3c"
}'

JavaScript (fetch)

const response = await fetch("https://auth.getmanifold.io/api/auth/apps/app_5bd0f3a8-2c4e-4a71-9e6b-0d3f1c2a7e40/join-requests", {
  method: "POST",
  headers: { Authorization: `Bearer ${process.env.MANIFOLD_TOKEN}`, "Content-Type": "application/json" },
  body: JSON.stringify({
    "claim": "eyJhbGciOiJIUzI1NiJ9.eyJhcHBJZCI6ImFwcF81YmQwZjNhOCIsImV4dGVybmFsVXNlcklkIjoiODgxMjA0In0.dm91Y2hlZC1ieS10aGUtYXBw",
    "presence": "eyJhbGciOiJIUzI1NiJ9.eyJleHRlcm5hbFVzZXJJZCI6Ijg4MTIwNCIsImF0IjoxNzkyNjI1MjAwfQ.cHJlc2VudC1ub3c"
  }),
});
if (!response.ok) throw new Error(`${response.status}: ${await response.text()}`);
const answer = await response.json();

Request body · application/json

{
  "claim": "eyJhbGciOiJIUzI1NiJ9.eyJhcHBJZCI6ImFwcF81YmQwZjNhOCIsImV4dGVybmFsVXNlcklkIjoiODgxMjA0In0.dm91Y2hlZC1ieS10aGUtYXBw",
  "presence": "eyJhbGciOiJIUzI1NiJ9.eyJleHRlcm5hbFVzZXJJZCI6Ijg4MTIwNCIsImF0IjoxNzkyNjI1MjAwfQ.cHJlc2VudC1ub3c"
}

Response · 200 · application/json

{
  "organizationId": "org_01a156d2-8680-7738-ab2e-ff985e454887",
  "organizationName": "Acme",
  "requestedAt": "2026-11-05T01:00:00.000Z",
  "created": true,
  "notified": true
}

The panel writes this call in other languages. It does not send it: Manifold's APIs do not take calls from a web page on another site, so run the call from your own code or terminal. The whole API as OpenAPI: auth-service.openapi.json. Base URL https://auth.getmanifold.io.

Errors

Every refusal is a status and a JSON body whose _tag names it. A refused call changes nothing.

`400`

Refusal	What it means	What to do
`ClaimInvalid` reason	The app's identity claim is unsigned, expired or for another app.	Get a fresh claim from the app.

`401`

Refusal	What it means	What to do
`Unauthorized` reason	The token is missing, expired or not one Manifold issued.	Get a fresh token and send the call again.
`TokenAlreadyUsed` tokenId	A single-use app token was already spent.	Mint a new token for this call.

`402`

Refusal	What it means	What to do
`SubscriptionRequired` status	The organization's subscription has lapsed, so writes are refused.	An owner settles billing. Reads still work meanwhile.

`403`

Refusal	What it means	What to do
`AppCannotAssertIdentity` appId, reason	This app may not vouch for who a person is.	Sign the person in directly.
`JoinRequestNotYours` reason	The request was refused. `reason` says why.	The caller may not do this. Use a token whose roles allow it.
`TenantRequired` userId	The token names no organization.	Choose the organization, then get a new token.
`ScopeRequired` required	The token's roles do not grant the scope this call needs.	Ask an owner or admin for a role that grants it.

`404`

Refusal	What it means	What to do
`AppNotFound` appId	No such record in this organization.	Check the id in the path or the body.

`409`

Refusal	What it means	What to do
`JoinRequestNotNeeded` reason	The request was refused. `reason` says why.	Nothing changed. Read the record, then decide.
`MirroredFromSource` source	This area is fed by your source system until the organization goes live.	Make the change in the source system, or go live first.

`503`

Refusal	What it means	What to do
`AppIdentityDisabled` reason	Signing in through apps is turned off on this deployment.	Send the same request again shortly.
`RequestLogUnavailable` tokenId, reason	The service could not record the request, so it did nothing.	Send the same request again shortly.

How refusals work everywhere: Errors.