Contents
User authentication and management
Provider-first OAuth authorize entrypoint. Internally forwards to /oauth2/authorize with the provider connection set. More
Responses
Provider-first OAuth callback entrypoint. Internally forwards to /oauth2/callback/:provider. More
Responses
Accept an invite to join an account using an invite token. Returns a login response if successful.
Users should receive a url either via email or other means with a unique token param such that following the link accepts the invite.
An invite is a one-time login, so the client is expected to either present a set password flow, or use email magic links/SSO from then on. More
Responses
Check if an email exists and which login methods are available. Used for multi-step login flows to determine next steps. More
Headers
Body application/json
Responses
Initialize a CSRF session cookie. Sets an HttpOnly, Secure, SameSite=Strict cookie used for CSRF token generation. Returns a JavaScript snippet for auto-fetching the token. More
Responses
Generate a CSRF token for the current session. Used to protect against Cross-Site Request Forgery attacks. Send in the X-CSRF-Token header of state-changing requests. More
Responses
Return currently available login methods for a client. Includes OAuth provider authorize/callback endpoints and password/magic-link submit URLs. More
Headers
Body application/json
Responses
Get the current authenticated user’s profile. Returns user info, email credentials, and account memberships. More
Responses
Exchange a refresh token for a new access token and refresh token.
You can use this endpoint in two ways:
- JSON body (direct API calls)
- Send
refresh_tokenin the JSON request body. - This is the usual choice for server-side code or scripts that call the HTTP API directly.
- Cookie-based session (browser or SDK clients)
- Send the request with credentials/cookies.
- If
refresh_tokenis not present in the JSON body, the server will try to read the refresh token from the configured refresh-token cookie (the default cookie name isrefresh_token).
Cookie-based refresh only works when the browser can send cookies to the auth service. In practice this means:
- The auth service is exposed on the same domain as your application, or
- Your application calls the auth service through a reverse proxy so that the browser sees a matching domain.
When the request uses cookies and the refresh succeeds, the server also updates the HTTP-only cookies with the new tokens.
Note that the access token’s contents are not changed by a refresh; it contains the same claims as the previous access token, but with a new expiration time.
Body application/json
Responses
Reset a user’s password using a token from the password reset email. Requires a strong password meeting complexity requirements. More
Body application/json
Responses
Send an email verification link to confirm ownership of an email address. Requires authentication. More
Headers
Body application/json
Responses
Send a one-time passwordless login link to the user’s email. The link authenticates the user when clicked. More
Headers
Body application/json
Responses
Send a password reset link to the user’s email. The link allows setting a new password when clicked. More
Headers
Body application/json
Responses
Authenticate a user with email and password. Returns access tokens, refresh tokens, and the user’s profile on success. More
Headers
Body application/json
Responses
Sign in a user using a one-time login token (e.g., from magic links, invite emails, or OTP flows). This endpoint is designed for direct navigation via emailed links, hence the GET method and query parameter.
The token is single-use, short-lived, and invalidated upon successful consumption. For security, ensure links are delivered over encrypted channels and include CSRF protections in redirect flows if applicable.
Unlike credential-based sign-in (POST /auth/sign-in), this endpoint does not require authentication headers and returns an AuthenticationResult on success, enabling immediate session establishment.
Headers
Responses
Register a new user with email and password. Creates a user, account, and returns authentication tokens on success. More
Headers
Body application/json
Responses
Verify a user’s email address using a verification token sent via email. Marks the email as verified on success. More
Responses
List the current user’s waitlist signups in the token account context. More
Responses
Idempotently remove the current user from a waitlist feature in the token account context. More
Responses
Check whether the current user is signed up for a waitlist feature in the token account context. More
Responses
Idempotently sign up the current user for a waitlist feature in the token account context. More