Authentication
Authentication and user registration service
login auth
Authenticate user credentials
reactivate account
Recover a deactivated or delete_pending account from a logged-out state by presenting credentials. Validates the password first, then (if needed) transitions the account back to active and issues a session exactly like login. Returns the same response shape as login.
logout auth
Logout user and revoke current session
refresh auth
Refresh an existing JWT token
register auth
Register a new user
forgot_password auth
Request a password-reset OTP for the given email. Always returns 200 with the
verify_reset_code auth
Validate the 6-digit OTP issued by /v1/auth/forgot-password. On success the
reset_password auth
Set a new password using the reset token returned by /v1/auth/verify-reset-code.
change_password auth
Change the password for the currently authenticated user. Requires the
send_verification_code auth
Send email verification code
verify_email auth
Verify email with code
google auth
Authenticate or register with Google
apple auth
Authenticate or register with Apple
Initialize 2FA setup
Generates a new TOTP secret and QR code for setting up two-factor authentication.
Verify and enable 2FA
Verifies a TOTP code and enables two-factor authentication for the user.
Verify 2FA code during login
Verifies a TOTP code or backup code during the login process.
Get 2FA status
Returns the current two-factor authentication status for the authenticated user
Disable 2FA
Disables two-factor authentication for the user. Requires password verification
Regenerate backup codes
Generates a new set of backup codes, replacing all existing ones.
Begin passkey registration
Starts adding a passkey to the authenticated user's account.
Finish passkey registration
Verifies the authenticator attestation and stores the passkey.
Begin passkey login
Starts a passkey login ceremony. Omit `identifier` for discoverable (usernameless) login. Always returns well-formed options (no user enumeration).
Finish passkey login
Validates the assertion and, on success, issues a full (non-2FA-pending) session — identical to password login.
List passkeys
Returns the authenticated user's registered passkeys.
Rename a passkey
Rename a passkey
Delete a passkey
Delete a passkey
next challenge
Account creation - verify next challenge