# Make a login code

**POST** `/api/embed/v1/login-codes`

Makes a one-time login code for a person, creating the person, account and workspace if they don’t exist.

Needs a partner key: `Authorization: Bearer gre_…`, from [Platform › Partner keys](https://docs.gorunner.io/embed/platform-screens#partner-keys). Call it from your server only.

Embed · Self-hosted with an Embed license

## Parameters

### Body

- `user` · Required · object: The person: your `id` (1 to 255 bytes), their `name` (up to 200 characters) and, if you like, `email`. The email is for contact only, never who they are.
- `account` · Required · object: The account: your `id` and its `name`.
- `workspace` · Optional · object: A workspace: your `id`, and its `name` the first time. Left out: the account’s default workspace.
- `role` · Required · string: `viewer`, `operator` or `editor`.
- `turnOff` · Optional · array of strings: Switch IDs to turn off for this login only.

## The code

Hand `code` to your page, which gives it to the frame. It works once, for 60 seconds. Never log it. See [Login codes and sessions](https://docs.gorunner.io/embed/sign-in-and-sessions).

A suspended account still gets a code: its people can look, read only. A changed role ends the person’s older sessions in that workspace, which come back at the new role.

It takes no `Idempotency-Key`: an unused code simply runs out. One person of one account gets 20 codes a minute (`EMBED_PERSON_RATE_LIMIT`), so throttle your own login route per person too.

## Responses

- 201 Created

  The code, and what was found or made.

- 400 `VALIDATION_ERROR`

  A field isn’t valid. `details.field` names it.

- 403 `ORG_LIMIT`

  The account is new, and the license’s organization limit is reached. Nothing is made.

- 403 `WORKSPACE_LIMIT`

  A workspace would be made (a new account’s default one, or a new `workspace.id`), and the license’s workspace limit is reached. Nothing is made.

- 409 `ACCOUNT_DELETED`

  The account is deleted. Restore it first, within 30 days.

- 409 `BUSY`

  Something else held what this call needs, and it gave up waiting. Nothing changed. Try again.

- 429 `RATE_LIMITED`

  Your key’s, the account’s or this person’s login codes this minute are used up. `X-RateLimit-Scope` says which; `Retry-After` says when.

- 500 `INTERNAL_ERROR`

  Something failed on the installation’s side. Try again.

Any call can also answer: [`401 UNAUTHORIZED`](https://docs.gorunner.io/errors#UNAUTHORIZED) · [`403 EMBED_NOT_LICENSED`](https://docs.gorunner.io/errors#EMBED_NOT_LICENSED) · [`403 IP_NOT_ALLOWED`](https://docs.gorunner.io/errors#IP_NOT_ALLOWED) · [`413 PAYLOAD_TOO_LARGE`](https://docs.gorunner.io/errors#PAYLOAD_TOO_LARGE) · [`415 INVALID_CONTENT_TYPE`](https://docs.gorunner.io/errors#INVALID_CONTENT_TYPE) · [`503 BUSY`](https://docs.gorunner.io/errors#BUSY). See [Errors](https://docs.gorunner.io/embed/api#errors).

Request

**curl**

```bash
GORUNNER="https://automations.example.com"
GORUNNER_EMBED_KEY="YOUR_PARTNER_KEY"  # gre_…

curl -X POST "$GORUNNER/api/embed/v1/login-codes" \
  -H "Authorization: Bearer $GORUNNER_EMBED_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "user": {
      "id": "ada-123",
      "name": "Ada Lovelace"
    },
    "account": {
      "id": "acct-bakery",
      "name": "Bakery Ltd"
    },
    "role": "editor"
  }'
```

**JavaScript**

```js
const GORUNNER = "https://automations.example.com";
const KEY = process.env.GORUNNER_EMBED_KEY; // gre_…

const res = await fetch(
  `${GORUNNER}/api/embed/v1/login-codes`,
  {
    method: "POST",
    headers: {
        Authorization: `Bearer ${KEY}`,
        "Content-Type": "application/json",
      },
    body: JSON.stringify({
        user: { id: "ada-123", name: "Ada Lovelace" },
        account: {
          id: "acct-bakery",
          name: "Bakery Ltd",
        },
        role: "editor",
      }),
  },
);
const { data } = await res.json();
```

**Python**

```python
import os, requests

GORUNNER = "https://automations.example.com"
KEY = os.environ["GORUNNER_EMBED_KEY"]  # gre_…

res = requests.post(
    f"{GORUNNER}/api/embed/v1/login-codes",
    headers={"Authorization": f"Bearer {KEY}"},
    json={
      "user": {
        "id": "ada-123",
        "name": "Ada Lovelace",
      },
      "account": {
        "id": "acct-bakery",
        "name": "Bakery Ltd",
      },
      "role": "editor",
    },
)
data = res.json()["data"]
```

Response · 201 Created

```json
{
  "data": {
    "code": "grl_…",
    "expiresAt": "2026-10-25T09:01:00Z",
    "expiresIn": 60,
    "account": {
      "id": "acct-bakery",
      "status": "active",
      "created": false
    },
    "workspace": {
      "id": null,
      "default": true,
      "created": false
    },
    "user": {
      "id": "ada-123",
      "created": true
    },
    "role": "editor"
  }
}
```

**Every field**

### Body

- `user` · Required · object
  - `id` · Required · string
  - `name` · Required · string
  - `email` · Optional · string or null
- `account` · Required · object
  - `id` · Required · string
  - `name` · Required · string
- `workspace` · Optional · object: Omitted = the account’s default workspace. `name` is needed the first time.
  - `id` · Required · string
  - `name` · Optional · string
- `role` · Required · string: One of `viewer`, `operator`, `editor`.
- `turnOff` · Optional · array of strings: Switches off for this login only. An id that does not exist is 400 `VALIDATION_ERROR` (`details.unknown`).

### Response · 201 Created

- `data` · object
  - `code` · string: `grl_…` — single use, 60 seconds.
  - `expiresAt` · time
  - `expiresIn` · integer
  - `account` · object
    - `id` · string
    - `status` · string: One of `active`, `suspended`.
    - `created` · boolean
  - `workspace` · object
    - `id` · string or null
    - `default` · boolean
    - `created` · boolean
  - `user` · object
    - `id` · string
    - `created` · boolean
  - `role` · string: One of `viewer`, `operator`, `editor`.

Related: [Login codes and sessions](https://docs.gorunner.io/embed/sign-in-and-sessions) · [Start a session](https://docs.gorunner.io/embed/api/sign-in/start-session) · [Quick start](https://docs.gorunner.io/embed/quick-start)

Source: https://docs.gorunner.io/embed/api/sign-in/issue-login-code