> ## Documentation Index > Fetch the complete documentation index at: https://docs.canary.effectiveai.app/llms.txt > Use this file to discover all available pages before exploring further. # Sign a browser in to an app > Sign a browser in to a deployed app so you can test it as a user would. Open the app signed out; it redirects to an `/app-authorize` URL. Pass that URL here, then open the returned `callbackUrl` in the same tab within a minute. The sign-in lasts 10 minutes. You act as yourself: the app sees your user, and with an API key its requests to Effective stay within the key’s grants and end when the key does. Needs `publish` permission on the app. To call the app’s API without a browser, use `callApp`. ## OpenAPI ````yaml /openapi.json post /apps/{appId}/sign-ins openapi: 3.0.3 info: title: Effective API version: 2.0.0 description: The public Effective REST API. Authenticate using an Effective API key. servers: - url: https://api.canary.effectiveai.app/api/v2 description: Canary security: - bearerAuth: [] paths: /apps/{appId}/sign-ins: post: tags: - Apps summary: Sign a browser in to an app description: >- Sign a browser in to a deployed app so you can test it as a user would. Open the app signed out; it redirects to an `/app-authorize` URL. Pass that URL here, then open the returned `callbackUrl` in the same tab within a minute. The sign-in lasts 10 minutes. You act as yourself: the app sees your user, and with an API key its requests to Effective stay within the key’s grants and end when the key does. Needs `publish` permission on the app. To call the app’s API without a browser, use `callApp`. operationId: createAppSignIn parameters: - schema: type: string maxLength: 63 pattern: ^app-[a-z0-9](?:[a-z0-9-]*[a-z0-9])?$ description: >- App ID: `app-` followed by lowercase letters, digits and hyphens, ending in a letter or digit. It is part of the app’s hostname, so your organization’s subdomain and the ID together must fit 63 characters. required: true description: >- App ID: `app-` followed by lowercase letters, digits and hyphens, ending in a letter or digit. It is part of the app’s hostname, so your organization’s subdomain and the ID together must fit 63 characters. name: appId in: path requestBody: required: true content: application/json: schema: $ref: '#/components/schemas/V2AppSignInCreate' responses: '200': description: Where to finish signing in. content: application/json: schema: $ref: '#/components/schemas/V2AppSignIn' '400': description: Invalid request or cursor. content: application/json: schema: $ref: '#/components/schemas/V2CodedError' '401': description: Authentication required. content: application/json: schema: $ref: '#/components/schemas/V2CodedError' '403': description: >- You lack the permission this needs on the app, or are a read-only member. content: application/json: schema: $ref: '#/components/schemas/V2CodedError' '404': description: 'app_not_found: missing, archived, or not an app you can open.' content: application/json: schema: $ref: '#/components/schemas/V2CodedError' '413': description: JSON request body exceeds 64 KiB. content: application/json: schema: $ref: '#/components/schemas/V2CodedError' '415': description: Content-Type must be application/json. content: application/json: schema: $ref: '#/components/schemas/V2CodedError' '500': description: Unexpected server error. content: application/json: schema: $ref: '#/components/schemas/V2CodedError' '503': description: Temporarily unavailable; retry later. content: application/json: schema: $ref: '#/components/schemas/V2CodedError' security: - bearerAuth: [] components: schemas: V2AppSignInCreate: type: object properties: authorizeUrl: type: string maxLength: 4096 format: uri description: >- The `/app-authorize` URL the app redirected your browser to when you opened it signed out. required: - authorizeUrl additionalProperties: false V2AppSignIn: type: object properties: callbackUrl: type: string format: uri description: >- Open this in the same browser tab, before `callbackExpiresAt`, to finish signing in. It works only in the tab that started sign-in. callbackExpiresAt: type: string format: date-time description: When `callbackUrl` stops working. signInExpiresInSeconds: type: integer description: How long the browser stays signed in once the callback is opened. required: - callbackUrl - callbackExpiresAt - signInExpiresInSeconds additionalProperties: false V2CodedError: allOf: - $ref: '#/components/schemas/V2Error' - type: object properties: code: type: string minLength: 1 description: Stable error code. Clients must tolerate unknown future codes. details: type: array items: type: object properties: location: type: string enum: - path - query - header - body path: type: array items: type: string maxLength: 64 maxItems: 12 code: type: string enum: - required - invalid_type - invalid_value - unknown_field message: type: string minLength: 1 maxLength: 200 required: - location - path - code - message minItems: 1 maxItems: 20 description: Bounded safe validation issues; may omit some invalid fields. requestId: type: string minLength: 1 maxLength: 128 description: >- Existing server correlation for this HTTP attempt, when available. dataset: type: string enum: - naic - osha description: Dataset needed for dataset_not_enabled. businessCode: type: string description: The rater’s own refusal code, for business_rejection. violations: type: array items: type: object properties: code: type: string description: Authored or built-in constraint code message: type: string description: Authored message for the failed constraint path: type: string description: Input path of the offending value; empty for the request value: nullable: true description: Offending input value, size-bounded by the runtime constraint: type: string description: The constraint the value failed, as text cite: type: string nullable: true description: >- Filing citation of the constraint, when the source cites one required: - code - message - path - value - constraint - cite additionalProperties: false maxItems: 256 description: >- Each input constraint the submission failed, for invalid_inputs and business_rejection. violationsTruncated: type: boolean description: >- True when the rater reported more violations than violations holds. executionId: type: string description: >- The recorded execution of a failed rating, for rater rating failures. accessUrl: type: string nullable: true format: uri description: >- Where to add the product to your account, for product_access_required. required: - code V2Error: type: object properties: error: type: string minLength: 1 description: Human-readable explanation of the failure. required: - error securitySchemes: bearerAuth: type: http scheme: bearer description: 'Effective API key. Send Authorization: Bearer sk-eai-...' ```` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.