POST
/api/agents/end-userno authSign a visitor in to an agent
Lets an agent have its own users without those people needing a Storkie account. Passwords are hashed with scrypt; the session is an opaque token scoped to one agent and useless against any other.
Try it
curl -X POST "https://storkie.ai/api/agents/end-user" \
-H "Content-Type: application/json" \
-d '{"agentId":"YOUR_AGENT_ID","mode":"signin","email":"a@b.com","password":"…"}'No Run button: every call bills the agent’s owner, and a button on a public page would let anyone spend a stranger’s credits.
Request body
| Name | Type | Description |
|---|---|---|
agentIdrequired | string | Which agent the account belongs to. |
moderequired | string | `signup` or `signin`. |
emailrequired | string | The visitor’s email. |
passwordrequired | string | Their password. |
Response
| Name | Type | Description |
|---|---|---|
tokenrequired | string | A session token scoped to this agent. |
userrequired | object | `{ uid, email }`. |
Worth knowing
- The token is not a JWT and is not shaped like one — the separator is `~` rather than `.` precisely so nothing mistakes it for one and tries to decode it.
- A token minted for one agent is rejected by every other. Verification requires the expected agent ID, so a leaked token cannot be replayed sideways.
Rate limit
20 / 5 min / IP, and 10 / 15 min / account
Errors
400— Missing fields, or a password that fails the strength check.401— Wrong email or password.409— That email already has an account with this agent.429— Too many attempts — the per-account limit is the anti-stuffing one.
Questions
Do these people get a Storkie account?
No. They exist only against your agent. That is the point.
Can I offer Google or WhatsApp sign-in?
Yes, once you supply your own provider credentials. Email and password is what works with no setup.