Skip to main content
POST
Sign up with email + password

Body

application/json
email
string<email>
required
password
string<password>
required
Minimum string length: 8
redirect_to
string<uri>

Allowlisted SPA path to return to after email confirmation.

invite_token
string

Optional product-invite token (pinv_…) from an invite link. When it resolves to a PENDING, email-bound invite whose own invitee email equals email exactly (trimmed, case-insensitive), the account is created with its email already verified and a session is issued ({ user }, no email_confirmation_required) — the invite email already proved inbox control. Applies on the Zitadel identity provider; on a GoTrue-backed deployment the token is ignored and the normal confirmation-required answer is returned. The invite is NOT accepted by this call (use POST /invites/accept). Any other value (unknown, used, expired, revoked, user-bound, or a different email) is silently ignored and the response is identical to a sign-up without the token; no response reveals whether a token exists or whether the email matched (MNE-1348).

Response

Account created. Either returns a full session (auto-confirm) or awaits email confirmation.

user
object
required

Supabase user shape. Fields beyond id and email are passthrough.