Two planes: sessions and API keys

A session token (from register or login) drives the account console under /v1/account. A per-account API key drives the data plane (documents). Both are sent as Authorization: Bearer <token>.

Register

Email must be valid and the password at least 8 characters. A duplicate email returns 409. On success you get a session, its expiry, and your account — including a default API key created automatically.

curl -X POST https://cloud.richtexteditor.com/v1/auth/register \
  -H "Content-Type: application/json" \
  -d '{ "email": "you@example.com", "password": "your-password", "name": "You" }'

# 200 OK
{
  "session": "…",
  "expiresAt": "2026-07-24T09:00:00Z",
  "account": {
    "id": "…", "email": "you@example.com", "name": "You", "plan": "free",
    "subscription": { "plan": "free", "effectivePlan": "free", "status": "active",
                      "currentPeriodEnd": null, "cancelsAtPeriodEnd": false },
    "keys": [ { "id": "…", "key": "rte_…", "label": "default", "revoked": false } ],
    "usage": { "documents": 0, "maxDocuments": 3, "apiKeys": 1, "maxApiKeys": 1 }
  }
}

Log in & out

Login returns the same shape as register; wrong credentials return 401. Sessions last 7 days by default. Logout invalidates the current session token.

curl -X POST https://cloud.richtexteditor.com/v1/auth/login \
  -H "Content-Type: application/json" \
  -d '{ "email": "you@example.com", "password": "your-password" }'

curl -X POST https://cloud.richtexteditor.com/v1/auth/logout \
  -H "Authorization: Bearer $SESSION"
# 200 OK  → { "ok": true }

Read your account

Authenticate with the session token to read plan, subscription, usage, and active keys.

curl https://cloud.richtexteditor.com/v1/account \
  -H "Authorization: Bearer $SESSION"

API keys

Create a key (optionally labelled). Exceeding your plan's key limit returns 402. Deleting a key revokes it — it stays on record as revoked rather than vanishing.

# Create
curl -X POST https://cloud.richtexteditor.com/v1/account/keys \
  -H "Authorization: Bearer $SESSION" \
  -H "Content-Type: application/json" \
  -d '{ "label": "production" }'
# 200 OK → { "id": "…", "key": "rte_…", "label": "production", "revoked": false }

# Revoke
curl -X DELETE https://cloud.richtexteditor.com/v1/account/keys/<id> \
  -H "Authorization: Bearer $SESSION"
# 200 OK → { "ok": true }

Subscriptions

Change plan by name (free, start, team, business). When a payment provider is configured, the response includes a checkoutUrl. Cancel with ?immediate=true to downgrade now instead of at period end.

curl -X POST https://cloud.richtexteditor.com/v1/account/subscription \
  -H "Authorization: Bearer $SESSION" \
  -H "Content-Type: application/json" \
  -d '{ "plan": "team" }'
# 200 OK → { "subscription": { … }, "checkoutUrl": "https://…" | null }

curl -X DELETE "https://cloud.richtexteditor.com/v1/account/subscription?immediate=true" \
  -H "Authorization: Bearer $SESSION"

Status codes

Next: the Documents API → or the full reference.