PandaIDX

Sign Up Visitor

Creates a visitor account on the site. The visitor becomes a contact in the site owner's CRM and gets an access token and a refresh token, so they are signed in right away.

POST/v1/auth/signup

Authentication

Public key?key=pk_…

Public key in the `key` query parameter. No OAuth, no secret. Browsers can call it only from the site's own origins (its domain, with or without www, and any widget origins the owner added). Server-side requests without an Origin header are accepted.

Edge cache: no-store

Query Parameters

keystring
required

The site's public key (pk_…). It selects the account. Safe to ship to the browser.

Body Parameters

namestring
required

Full name, at least 3 characters.

emailstring
required

Email address. It is trimmed and lowercased, and it becomes the visitor's login.

passwordstring
required

Password, 8 to 20 characters.

phonestring
required

Phone number, stored on the contact. The field is required, but an empty string is accepted.

marketingConsentboolean
required

Must be `true`. Show a consent checkbox and send what the visitor chose; `false` is rejected.

langstring
optional

Page language code (for example `es`). Picks the language of the email the site owner receives. English when omitted.

analyticsobject
optional

Optional `{ visitorId, sessionId }` (two UUIDs, the same ones you send to the analytics endpoint). It attributes the `signup` analytics event to the visitor.

Responses

200Success
application/json
titlestring
hideToastboolean
typestring
variantstring
messagestring
accessTokenstring
refreshTokenstring
expiresInnumber

Errors

400Validation failed or the email is taken. Every failure answers 400; the body has `type: "error"`, `message`, an inner `status` (such as 422) and `errors` keyed by field, for example `errors.email.message`.
401Missing or invalid public key.
403The Panda account is not active. The body also carries `code: "TENANT_INACTIVE"`.

Notes

  • Creates a CRM contact for the site owner (stage `active-client`, source `signup-form`). If the email already exists as an unregistered lead, that contact is upgraded instead of duplicated.
  • The owner gets an in-app notification, and the contact's activity feed records the sign up.
  • A dashboard team member or an already registered contact with the same email gets `Email already exists`.
  • Tokens: `accessToken` lasts 1 hour (`expiresIn` is in seconds). `refreshToken` lasts 60 days and renews every time you refresh. Send the access token as `Authorization: Bearer`, never as a cookie.
Request
curl --request POST \
  --url "https://api.pandaidx.com/v1/auth/signup?key={{public_key}}" \
  --header "Content-Type: application/json" \
  --data '{"name":"Alex Example","email":"alex.example@example.com","password":"ChangeMe-Example-1","phone":"305-555-0142","marketingConsent":true}'
Response200 OK
{
  "title": "You've signed up successfully",
  "hideToast": false,
  "type": "success",
  "variant": "default",
  "message": "You've signed up successfully",
  "accessToken": "v1.example-access-token",
  "refreshToken": "example-refresh-token",
  "expiresIn": 3600
}