v24

latestOpenAPI 3.0.3raw.githubusercontent.com2026-08-014382230.2 KB

Authentication

Root user programmatic signin

Authenticates the root user using HMAC signature for programmatic access. This endpoint is designed for automation scenarios like Infrastructure-as-Code deployments, CI/CD pipelines, and automated testing where magic link authentication is impractical.

Security Features:

HMAC-SHA256 signature verification using the application's secret key
60-second timestamp window to prevent replay attacks
Rate limited to 5 attempts per 5 minutes per email
Only works for a configured root email address (ROOT_EMAIL may list several, comma/semicolon-separated)

How to generate the signature:

SECRET_KEY="your-notifuse-secret-key"
ROOT_EMAIL="admin@example.com"
TIMESTAMP=$(date +%s)
MESSAGE="${ROOT_EMAIL}:${TIMESTAMP}"
SIGNATURE=$(echo -n "$MESSAGE" | openssl dgst -sha256 -hmac "$SECRET_KEY" | awk '{print $2}')

post/api/user.rootSignin

Request body

emailstring email required

The root user's email address (must match one of the configured ROOT_EMAIL addresses)

timestampinteger required

Unix timestamp (seconds since epoch). Must be within 60 seconds of server time.

signaturestring required

HMAC-SHA256 signature computed as: HMAC-SHA256(email + ":" + timestamp, SECRET_KEY) The signature should be hex-encoded.

Example request

{
  "email": "admin@example.com",
  "timestamp": 1735600000,
  "signature": "a1b2c3d4e5f6..."
}

Response

Authentication successful

tokenstring required

JWT authentication token for subsequent API requests

expires_atstring date-time required

Token expiration timestamp

Example response

{
  "token": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...",
  "user": {
    "id": "usr_1234567890",
    "email": "admin@example.com",
    "name": "Admin User",
    "language": "en",
    "created_at": "2025-01-01T00:00:00Z",
    "updated_at": "2025-01-01T00:00:00Z"
  },
  "expires_at": "2025-01-01T12:00:00Z"
}