create_login_link
Mint a one-time human login URL and session id so you can prove an end user. Call webhook_allowlist_add first when using webhook, redirect, form_post or post_message. Requires a company API key (aa_...) or an MCP OAuth access token and an active plan. A missing subscription returns an error result with code subscription_required (meter status 402). Exhausted quota returns code quota_exceeded (meter status 429). Too many creates can return code rate_limited. Returns ok, sessionId, loginUrl, expiresAt, methods, alwaysOn, and forceReauth. poll and sse are always included. Optional methods are webhook, redirect, post_message, and form_post. SMS is not offered. The default reuses the company cookie (Continue-as). Set force_reauth true, or reuse_session false, for a fresh login. When ttl_seconds is omitted, the link lasts 900 seconds. Poll with get_login_status using sessionId. If a webhook notify fails, use retry_login_webhook.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| state | No | Optional opaque string echoed back on status and notify payloads so you can correlate the session. | |
| methods | No | Optional notify channels to add. poll and sse stay available even when this is omitted. If this is omitted, a provided webhook_url, redirect_uri, post_message_origin, or form_post_uri turns that channel on. There is no SMS method. | |
| ttl_seconds | No | Optional lifetime of the login link, in seconds. When omitted, the server uses 900 seconds. There is no maximum clamp. | |
| webhook_url | No | URL that receives the signed webhook after login. It must match a prefix from webhook_allowlist_add. Use https (http only for localhost when the environment is local). Required when webhook is enabled. | |
| force_reauth | No | When true, require a fresh login. When false or omitted, the company cookie can be reused (Continue-as), unless reuse_session is false. | |
| redirect_uri | No | Browser redirect after login, such as an https URL or a cursor:// deep link. It must match an allowlisted prefix. Required when redirect is enabled. | |
| form_post_uri | No | http(s) URL that receives an unsigned browser form POST with session_id, status, user_id, email, and state. It must match an allowlisted prefix. Required when form_post is enabled. Production requires https except localhost. Custom schemes are rejected. | |
| reuse_session | No | When false, require a fresh login (same effect as force_reauth true). When true or omitted, it does not override force_reauth true. The tool result reports forceReauth, not this field. | |
| post_message_origin | No | http(s) origin (scheme://host[:port]) that should receive the agent_auth.login_completed postMessage. Required when post_message is enabled. Its origin must match an allowlisted prefix (the path is ignored). Production requires https except localhost. |