Authentication

External requests have two access layers. The client token allows an approved, allowlisted integration to reach the API. The Authorization credential then identifies the user or account and determines access to data.

Treat every credential as sensitive. Do not commit credentials to source control, include them in logs, or expose them in a public client.

External integration access

API access outside the official célula.in application requires prior approval. The church must be approved and allowlisted by célula.in before an integration can make production requests.

After approval, célula.in provisions a client token. Send it in the X-CIN-API-Token header on every external request. Store it in a server-side secret such as CELULAIN_CLIENT_TOKEN; never embed it in a public website or mobile application.

Contact célula.in to request access or change the integration’s allowlisting.

User access tokens

Exchange a person’s email, password, and account alias at POST /authenticate for a user access token.

New access tokens are issued with a 365-day expiration. A token can stop working earlier when its person or account is deactivated. Permissions are resolved from the current person record on each request.

usernamestringrequired

The person's email address.

passwordstringrequired

The password, containing 6–140 characters.

accountstringrequired

The account alias, also called the account subdomain.

Find an account alias

If an email address belongs to more than one account, send username to POST /authenticate-username before authenticating. The endpoint returns the available account aliases, or 401 Unauthorized when the email does not match an account.

Authenticate a request

Send the user token with the Bearer authorization scheme. The token identifies both the person and account. Access can also depend on the person’s current administrative status, roles, and resource scope.

Public API authentication

Public /p/v1 requests use the account identifier with the Account authorization scheme. This selects the account whose public data or form is being accessed. It does not grant the permissions of a user access token.

Authentication errors

• 401 Unauthorized means user or account credentials are missing, malformed, invalid, or no longer identify an active person.
• 403 Forbidden means the church is not approved and allowlisted, the account is inactive, or the authenticated person lacks permission for the operation.

See Errors for the complete error document format.

Authenticate

curl https://api.celula.in/authenticate \
  --request POST \
  --header "X-CIN-API-Token: $CELULAIN_CLIENT_TOKEN" \
  --header "Content-Type: application/json" \
  --data '{
    "username": "developer@example.com",
    "password": "your-password",
    "account": "your-church-alias"
  }'

Authentication response

{
  "access_token": "<access_token>",
  "account": "66c5f0ec7e70d42c6a9a8afa"
}

Find account aliases

curl https://api.celula.in/authenticate-username \
  --request POST \
  --header "X-CIN-API-Token: $CELULAIN_CLIENT_TOKEN" \
  --header "Content-Type: application/json" \
  --data '{"username":"developer@example.com"}'

Authenticated request

curl https://api.celula.in/v1/people/me \
  --header "X-CIN-API-Token: $CELULAIN_CLIENT_TOKEN" \
  --header "Authorization: Bearer $CELULAIN_ACCESS_TOKEN" \
  --header "Accept: application/vnd.api+json"

Public API request

curl https://api.celula.in/p/v1/events \
  --header "X-CIN-API-Token: $CELULAIN_CLIENT_TOKEN" \
  --header "Authorization: Account $CELULAIN_ACCOUNT_ID" \
  --header "Accept: application/vnd.api+json"