API reference: Auth

Session endpoints used by the web app; dev-login is never available in production.

Method	Path	What it does
`POST`	`/v1/auth/dev-login`	Dev-only login (mints a session without Google/Clerk) 404 unless AUTH_DEV_LOGIN_ENABLED; never available in production.
`POST`	`/v1/auth/logout`	Revoke the current web session and clear the cookie
`GET`	`/v1/auth/me`	Current principal + user + memberships (account switcher)
`POST`	`/v1/auth/clerk/sync`	Ensure Clerk-user provisioning ran; returns the me payload Provisioning (user + personal account + owner membership) happens on first authenticated request; this endpoint exists so the web app can force it after sign-up.

Conventions

Base URL: https://api.docuflex.net; tenant routes are /v1/accounts/{accountId}/....
Auth: x-api-key: dfx_live_..., or Authorization: Bearer <OAuth2 access token>.
Errors: always {"error":{"code","message","details","requestId"}}; the requestId is also in the x-request-id header.
Pagination: offset (?page=&pageSize=, max 100) or cursor (?cursor=&limit=, follow nextCursor until hasMore is false).
Idempotency: any POST or PUT accepts Idempotency-Key; same key + different body is 409 IDEMPOTENCY_KEY_REUSED.
Rate limits: X-RateLimit-Limit, X-RateLimit-Remaining, X-RateLimit-Reset on every response; 429 RATE_LIMITED with Retry-After.
Tabs: coordinates are fractions of the page (origin top-left); documentIndex and recipientIndex refer to positions in the same request.
Spec: /openapi.json (OpenAPI 3). TypeScript client @docuflex/sdk; Postman and Bruno collections ship with the repo.