---
title: "Sign up a new user"
url: https://docs.gleap.ai/en/reference/rest-api/post-users
method: POST
path: "/users"
api: "API Reference"
tag: "User"
operationId: "Create"
updatedAt: "2026-11-01T18:40:15.677Z"
language: en
---

# Sign up a new user

`POST https://api.gleap.io/v3/users`

Register a new dashboard user. Sends a 6-digit verification code by email and returns a JWT plus the created (still unconfirmed) user. `email`, `name` and `turnstileToken` are required in practice; a `name` containing a URL is rejected as spam. Rate limited to 30 requests per hour per IP.

## Request body (`application/json`, required)

- `openAIAdsConsent` (boolean)
- `openAIAdsClickRef` (string)
- `openAIAdsBrowserRef` (string)
- `name` (string)
- `email` (string)
- `referral` (string)
- `utm_source` (string | null)
- `utm_medium` (string | null)
- `utm_term` (string | null)
- `utm_content` (string | null)
- `utm_campaign` (string | null)
- `onboardingFlow` (string)
- `turnstileToken` (string)
- `gaClientId` (string)
- `gaSessionId` (string)
- `gaSessionIds` (object): A free-form string map. Declared as an index signature, not `Record<string, string>`: tsoa renders a Record as an object without properties, and with `noImplicitAdditionalProperties: silently-remove-extras` every key was stripped at the route before the service saw it (the ad click ids and the GA session ids arrived empty).
- `adClickIds` (object): First-touch ad click ids of the visit (gclid, gbraid, wbraid, msclkid, fbclid, li\_fat\_id). Stored once, never overwritten.
- `acquisitionTouch` (object): One immutable, sanitized marketing visit; ad IDs identify spend rows.
- `adConsent` (string): The visitor's Cookiebot marketing decision on the marketing site (`granted` | `denied`), forwarded as `ad_consent`. Last decision wins; see signupAttribution.ts adConsentChanges.
- `ref` (string | null): `ref` of the "Powered by Gleap" badge the visit came from (first touch).
- `landingPage` (string | null): First dashboard page of the visit (first touch).
- `referrer` (string | null): Page that referred the first visit (first touch).

## Example request

```bash
curl --request POST \
  --url https://api.gleap.io/v3/users \
  --header 'Content-Type: application/json' \
  --data '{
  "openAIAdsConsent": true,
  "openAIAdsClickRef": "<openAIAdsClickRef>",
  "openAIAdsBrowserRef": "<openAIAdsBrowserRef>",
  "name": "<name>"
}'
```

## Responses

### 200 (`application/json`)

Ok