Guest accounts

A coding agent can set SunLicense up for you without stopping to ask for an email or password: it creates a guest account, an organization of your own with an Owner token, and you claim it later by adding your email. Claiming keeps everything the agent made: products, plans, licenses, API keys and the token itself.

The SunLicense CLI does this for you (sunlicense init, then sunlicense claim and sunlicense open). Everything below is plain HTTPS, so it also works from tools without the CLI.

What a guest account can do

A guest account has the Free plan's limits, minus everything that reaches people outside your organization or hosts something for it, until it's claimed:

Works	Needs a claimed account
Products, plans, up to 10 licenses, customers	An 11th license
API keys and license checks from your software (never limited)	Customer emails, invitations
Personal access tokens, the CLI, MCP	Discord, webhooks, automations
Offline licenses, blacklists, analytics your plan includes	Customer portal, custom domains, product downloads, marketplaces, tasks
The dashboard (sunlicense open)	Paying for a plan

Anything in the right column answers 403 with code: guest_unclaimed and a sentence saying how to claim.

Unclaimed guest accounts are deleted 30 days after they were last used. Use is any API or CLI call with the account's token, a dashboard sign-in, or license checks in a calendar month (which count until the end of that month). There is no email to warn you, so the dashboard shows a banner and every CLI command prints the date. Claim the account before you ship software that depends on it: once it's deleted, its license keys stop validating.

Create one

curl -sS -X POST https://api.sunlicense.com/api/v1/auth/guest \
  -H 'Content-Type: application/json' \
  -d '{"name": "My Game", "client": "my-setup-script/1.0"}'

Both fields are optional (name defaults to "My workspace" and can't contain a link). The answer (201):

{
  "token": "slp_…",
  "tenantId": "…",
  "organization": "My Game",
  "guest": true,
  "deleteAfter": "2026-11-29T10:00:00Z",
  "claimUrl": "https://app.sunlicense.com/claim?code=…",
  "claimExpiresAt": "2026-11-06T10:00:00Z"
}

token is a personal access token of the Owner with every permission and no expiry. Keep it like a password (the CLI stores it in its config file, readable only by you) and send it as Authorization: Bearer slp_… on every API call. Give the person the claimUrl.

Creating guest accounts is limited per network and per day across SunLicense: past the limit you get 429 with code: guest_limit and a Retry-After header. Then sign up instead and use sunlicense login.

Claim it

Open the claim link in a browser and enter an email and a password (the page runs the same checks as signing up). The account keeps its guest limits until you confirm the email from the message we send; after that it's a normal Free organization and the agent's token keeps working.

Already have an account? Everything moves into it

If the email already has a SunLicense account, use that account's password on the claim page, or simply run sunlicense login on the computer the agent used. Either way the guest's products, policies, customers and licenses move into your own organization (the one you last used where you're an Owner or Admin), with nothing to choose:

• License keys stay the same, and so do their statuses.
• The API key moves too, token unchanged, so the project's .env and your app keep working as they are.
• A product with the same name in your organization is used instead of a second copy, and its policy of the same name likewise.
• Machines register again on their next license check (they aren't copied).
• The guest organization is deleted an hour later. Customers aren't emailed about any of it.

Two cases don't move: an organization that is still waiting for its email confirmation (confirm it, then sign in again), and a move that doesn't fit your plan (on Free, three products in all). Then the CLI says so and the guest stays as it is; on a paid plan that's full the claim page adds the guest to your account as an organization of its own instead.

The CLI uses POST /api/v1/auth/guest/move with {"token": "<the guest's slp_ token>"} and your own sign-in (it needs org.manage there); it answers with the organization and how many products, licenses and API keys now live there.

A claim link works once and for 7 days. Ask for a fresh one with the token (older ones stop working):

curl -sS -X POST https://api.sunlicense.com/api/v1/auth/guest/claim-link -H "Authorization: Bearer $SUNLICENSE_TOKEN"
# {"url": "https://app.sunlicense.com/claim?code=…", "expiresAt": "…"}

Open the dashboard without a password

curl -sS -X POST https://api.sunlicense.com/api/v1/auth/guest/sign-in-link -H "Authorization: Bearer $SUNLICENSE_TOKEN"
# {"url": "https://app.sunlicense.com/guest-sign-in?code=…", "expiresAt": "…"}

The link signs you in once, within 10 minutes. After the account is claimed both routes answer 409 with code: guest_claimed: sign in with your email and password instead.

Is it still a guest?

GET /api/v1/auth/me with the token has guest, guestDeleteAfter (when it goes if unused) and guestClaimPending (an email was given and waits for confirmation).