API: Programmatic User Registration

Create an aiAllure user programmatically. This endpoint is intended for trusted partners and internal services. It supports affiliate attribution and subid tracking via publicMetadata, and can optionally return a one-time sign-in link so the user lands already authenticated on a target page.

Authentication

Send a valid API key in the X-API-Key header. Your key must match one of the configured server keys.

• Header: X-API-Key: <your_internal_key>
• Header: Content-Type: application/json

POST /api/register HTTP/1.1
Host: www.aiallure.com
Content-Type: application/json
X-API-Key: <YOUR_INTERNAL_KEY>

Request Body

At least email and password are required.

• email (string) — User email address
• password (string) — User password
• firstName (string) — Optional
• lastName (string) — Optional

Attribution & tracking:

• affiliateId (string) — Saved as <affiliateId>
• subsIds (object|string) — Sub-ID container; object or JSON string (keys: sub1..sub5)
• clickId (string) — Click identifier for attribution

Optional sign-in link:

• issueSignInLink (boolean) — If true, the API will create a short-lived one-time sign-in token and return a prebuilt link
• redirectUrl (string) — Optional relative path (e.g., /companion/new) where the user will be redirected after sign-in completes

Example (object subsIds)

{
  "email": "john.doe@gmail.com",
  "password": "123456",
  "firstName": "John",
  "lastName": "Doe",
  "subsIds": {
    "sub1": "test",
    "sub2": "adgroup-A",
    "sub3": "creative-7"
  },
  "clickId": "clk_789"
}

Example (string subsIds)

{
  "email":  "john.doe@gmail.com",
  "password": "123456",
  "firstName": "John",
  "lastName": "Doe",
  "subsIds": "{"sub1":"test","sub2":"adgroup-A","sub3":"creative-7"}",
  "clickId": "clk_789"
}

cURL Example

curl -X POST "https://www.aiallure.com/api/register"   -H "Content-Type: application/json"   -H "X-API-Key: $INTERNAL_API_KEY_v2"   -d '{
    "email": "john.doe@gmail.com",
    "password": "123456",
    "firstName": "John",
    "lastName": "Doe",
    "subsIds": {"sub1":"test","sub2":"adgroup-A","sub3":"creative-7"},
    "clickId": "clk_789",
    "issueSignInLink": true,
    "redirectUrl": "/companion/new"
  }'

Response

Status: 201 Created

{
  "id": "user_2X...",
  "createdAt": 1726480000000,
  "emailAddresses": [
    { "id": "idn_...", "emailAddress": "john.doe@gmail.com", "verification": { /* ... */ } }
  ],
  "phoneNumbers": [],
  "username": null,
  "externalId": null,
  "publicMetadata": {},
  "signInLink": "https://www.aiallure.com/signin-token?token=...&redirect=/companion/new"
}

Attribution fields are stored in publicMetadata (not returned by default in this response). Our webhooks process this for database upserts and affiliate postbacks.

One-time Sign-In Flow

• Link: The API returns signInLink when issueSignInLink is true. Partners can redirect users to this URL.
• Consumer: The page /signin-token securely exchanges the token for a session and redirects to redirect (defaults to /).
• TTL: Tokens are short-lived (about 10 minutes) and one-time use. Expired/used tokens redirect to /sign-in.
• Security: redirectUrl must be a relative path starting with / to prevent open redirects.

Error Responses

• 400 Bad Request — Invalid JSON, invalid field types, or missing identifiers
• 401 Unauthorized — Missing/invalid X-API-Key
• 500 Server Error — Misconfiguration or upstream error

{ "error": "Unauthorized" }

Behavior & Webhooks

• The app listens to webhooks (e.g., user.created, session.created).
• On these events, the backend upserts the user into the database and may trigger affiliate postbacks using publicMetadata values.

Security

• Keep your API keys secret. Do not embed them in client-side code or public repositories.

Updated: 2025-09-25