---
url: https://docs.sunlicense.com/guide/guest-accounts.md
---
# Guest accounts

A coding agent can set SunLicense up for you without stopping to ask for an email or password: it creates a
**guest account**, an organization of your own with an Owner token, and you **claim** it later by adding your
email. Claiming keeps everything the agent made: products, plans, licenses, API keys and the token itself.

The SunLicense CLI does this for you (`sunlicense init`, then `sunlicense claim` and `sunlicense open`). Everything
below is plain HTTPS, so it also works from tools without the CLI.

## What a guest account can do

A guest account has the [Free plan](./plans)'s limits, minus everything that reaches people outside your
organization or hosts something for it, until it's claimed:

| Works | Needs a claimed account |
|---|---|
| Products, plans, up to **10 licenses**, customers | An 11th license |
| API keys and license checks from your software (never limited) | Customer emails, invitations |
| Personal access tokens, the CLI, [MCP](./ai-assistants) | Discord, webhooks, automations |
| Offline licenses, blacklists, analytics your plan includes | Customer portal, custom domains, product downloads, marketplaces, tasks |
| The dashboard (`sunlicense open`) | Paying for a plan |

Anything in the right column answers `403` with `code: guest_unclaimed` and a sentence saying how to claim.

**Unclaimed guest accounts are deleted 30 days after they were last used.** Use is any API or CLI call with the
account's token, a dashboard sign-in, or license checks in a calendar month (which count until the end of that
month). There is no email to warn you, so the dashboard shows a banner and every CLI command prints the date.
Claim the account before you ship software that depends on it: once it's deleted, its license keys stop validating.

## Create one

```bash
curl -sS -X POST https://api.sunlicense.com/api/v1/auth/guest \
  -H 'Content-Type: application/json' \
  -d '{"name": "My Game", "client": "my-setup-script/1.0"}'
```

Both fields are optional (`name` defaults to "My workspace" and can't contain a link). The answer (`201`):

```json
{
  "token": "slp_…",
  "tenantId": "…",
  "organization": "My Game",
  "guest": true,
  "deleteAfter": "2026-11-29T10:00:00Z",
  "claimUrl": "https://app.sunlicense.com/claim?code=…",
  "claimExpiresAt": "2026-11-06T10:00:00Z"
}
```

`token` is a [personal access token](/api/overview#personal-access-tokens) of the Owner with every permission and no expiry. Keep it
like a password (the CLI stores it in its config file, readable only by you) and send it as
`Authorization: Bearer slp_…` on every [API](/api/overview) call. Give the person the `claimUrl`.

Creating guest accounts is limited per network and per day across SunLicense: past the limit you get `429` with
`code: guest_limit` and a `Retry-After` header. Then [sign up](https://app.sunlicense.com/signup) instead and use
`sunlicense login`.

## Claim it

Open the claim link in a browser and enter an email and a password (the page runs the same checks as signing
up). The account keeps its guest limits until you confirm the email from the message we send; after that it's a
normal Free organization and the agent's token keeps working.

## Already have an account? Everything moves into it

If the email already has a SunLicense account, use that account's password on the claim page, or simply run
`sunlicense login` on the computer the agent used. Either way the guest's products, policies, customers and
licenses **move into your own organization** (the one you last used where you're an Owner or Admin), with
nothing to choose:

* **License keys stay the same**, and so do their statuses.
* **The API key moves too, token unchanged**, so the project's `.env` and your app keep working as they are.
* A product with the same name in your organization is used instead of a second copy, and its policy of the
  same name likewise.
* Machines register again on their next license check (they aren't copied).
* The guest organization is deleted an hour later. Customers aren't emailed about any of it.

Two cases don't move: an organization that is still waiting for its email confirmation (confirm it, then sign
in again), and a move that doesn't fit your plan (on Free, three products in all). Then the CLI says so and the
guest stays as it is; on a paid plan that's full the claim page adds the guest to your account as an
organization of its own instead.

The CLI uses `POST /api/v1/auth/guest/move` with `{"token": "<the guest's slp_ token>"}` and your own sign-in
(it needs `org.manage` there); it answers with the organization and how many products, licenses and API keys
now live there.

A claim link works once and for 7 days. Ask for a fresh one with the token (older ones stop working):

```bash
curl -sS -X POST https://api.sunlicense.com/api/v1/auth/guest/claim-link -H "Authorization: Bearer $SUNLICENSE_TOKEN"
# {"url": "https://app.sunlicense.com/claim?code=…", "expiresAt": "…"}
```

## Open the dashboard without a password

```bash
curl -sS -X POST https://api.sunlicense.com/api/v1/auth/guest/sign-in-link -H "Authorization: Bearer $SUNLICENSE_TOKEN"
# {"url": "https://app.sunlicense.com/guest-sign-in?code=…", "expiresAt": "…"}
```

The link signs you in once, within 10 minutes. After the account is claimed both routes answer `409` with
`code: guest_claimed`: sign in with your email and password instead.

## Is it still a guest?

`GET /api/v1/auth/me` with the token has `guest`, `guestDeleteAfter` (when it goes if unused) and
`guestClaimPending` (an email was given and waits for confirmation).