Hourivo API Authentication

This page is the Hourivo auth docs. The API is multi-tenant. Almost every product endpoint needs two headers: a Bearer JWT identifying the user, and an organization UUID so data stays isolated to one workspace. Public exceptions are listed below so agents do not send tokens where they are not required.

When you need a token

Use authentication when you are creating projects, logging time, listing screenshots, generating invoices, or asking the Hourivo assistant about a specific team. Do not send a token to GET /api/v1/health, GET /api/v1/info, or GET /api/v1/auth/legal — those are public discovery endpoints. Client portal reads use a share token in the path instead of a JWT.

Obtain a JWT

  1. Request an email OTP with POST /api/v1/auth/send-otp and {"email":"you@agency.com"}.
  2. Confirm the code with POST /api/v1/auth/verify-otp.
  3. Register with POST /api/v1/auth/register (email, fullName, organizationName, password, otp, acceptedTerms: true) or log in with POST /api/v1/auth/login.
  4. Read data.token and data.organization.id (or data.activeOrganization.id) from the JSON response.
  5. If data.user.needsLegalAcceptance is true, call POST /api/v1/auth/accept-terms with the version from GET /api/v1/auth/legal (currently 2026.8). Stale versions are rejected.
curl -X POST /api/v1/auth/login \
  -H 'Content-Type: application/json' \
  -d '{"email":"you@agency.com","password":"your-password"}'

Terms and Privacy (required)

New accounts and invite joins must accept the current Terms of Service and Privacy Policy. Public documents: /terms and /privacy. Public version JSON: GET /api/v1/auth/legal. Authenticated stamp: POST /api/v1/auth/accept-terms. Invite join: POST /api/v1/auth/accept-invite with acceptedTerms: true.

Call protected endpoints

Rate limit is 120 requests per minute per IP. HTTP 429 includes a Retry-After hint. Errors are JSON with success, code, message, and hint — never HTML.

Related developer resources