Auth

OSForms uses email and password with a 6-digit email code for verification. Logging in issues a JWT in an httpOnly cookie (ff_token, valid for 7 days). Dashboard endpoints also accept the same JWT as Authorization: Bearer <token>.

For server-to-server access to submissions, create an API key instead of using a login session.

POST /api/auth/signup

{
  "name": "Jane Smith",
  "email": "[email protected]",
  "password": "at-least-8-characters"
}

Creates the account and emails a 6-digit code. The account can’t log in until the code is verified.

{ "requiresVerification": true, "email": "[email protected]" }

Status	Meaning
`201`	Account created, verification code sent
`400`	Validation failed (see `details`)
`409`	An account with this email already exists

Verify email

POST /api/auth/verify-email

{
  "email": "[email protected]",
  "code": "123456"
}

On success, sets the ff_token cookie and returns the user:

{
  "success": true,
  "user": {
    "id": "64f1a2b3c4d5e6f7a8b9c0d1",
    "name": "Jane Smith",
    "email": "[email protected]",
    "isVerified": true,
    "onboardingComplete": false
  }
}

Codes expire after 30 minutes. A wrong or expired code returns 400.

Resend verification code

POST /api/auth/resend-otp

{ "email": "[email protected]" }

Sends a new code. You can request one every 60 seconds. Sooner returns 429 with retryAfter (seconds) in the body.

Log in

POST /api/auth/login

{
  "email": "[email protected]",
  "password": "your-password"
}

Sets the ff_token cookie and returns the user:

{
  "user": {
    "id": "64f1a2b3c4d5e6f7a8b9c0d1",
    "name": "Jane Smith",
    "email": "[email protected]",
    "onboardingComplete": true,
    "isVerified": true
  }
}

If the email isn’t verified yet, no cookie is set and the response is { "requiresVerification": true, "email": "..." } (status 200). Verify with the code to finish logging in.

Status	Meaning
`200`	Logged in, or verification still required
`400`	Malformed request
`401`	Invalid email or password

Log out

POST /api/auth/logout

Clears the ff_token cookie. No body required.

Get current user

GET /api/auth/me

{
  "user": {
    "id": "64f1a2b3c4d5e6f7a8b9c0d1",
    "name": "Jane Smith",
    "email": "[email protected]",
    "isVerified": true,
    "onboardingComplete": true,
    "fullName": "Jane Smith",
    "website": "https://example.com",
    "company": "Acme",
    "role": "developer"
  }
}

Returns 401 if not logged in. For this month’s submission usage, see usage in GET /api/v1/forms.

Google OAuth (Google Sheets)

Google OAuth only connects Google Sheets to a form. It isn’t a way to log in to OSForms.

GET /api/auth/google/login?formId={formId}

Requires your login session, and you must own the form. Redirects to Google’s consent screen. Google then redirects to /api/auth/google/callback, which creates a spreadsheet for the form and saves the encrypted OAuth token for the Google Sheets integration. The connection has to be finished within 10 minutes, in the same browser session that started it.

Submission

Forms

Integrations

Auth

Verify email

Resend verification code

Log in

Log out

Get current user

Google OAuth (Google Sheets)

​Sign up

​Verify email

​Resend verification code

​Log in

​Log out

​Get current user

​Google OAuth (Google Sheets)

Sign up

Verify email

Resend verification code

Log in

Log out

Get current user

Google OAuth (Google Sheets)