Auth

Authentication and session endpoints

Post Auth Verify

Verify an email address by requesting a one-time password. The code is valid for 15 minutes and is single-use.

Request Body

application/jsonRequired

emailRequiredstring

Format: "email"

Response Body

curl -X POST "https://example.com/auth/verify" \
  -H "Content-Type: application/json" \
  -d '{
    "email": "user@example.com"
  }'

const body = JSON.stringify({
  "email": "user@example.com"
})

fetch("https://example.com/auth/verify", {
  body
})

package main

import (
  "fmt"
  "net/http"
  "io/ioutil"
  "strings"
)

func main() {
  url := "https://example.com/auth/verify"
  body := strings.NewReader(`{
    "email": "user@example.com"
  }`)
  req, _ := http.NewRequest("POST", url, body)
  req.Header.Add("Content-Type", "application/json")
  res, _ := http.DefaultClient.Do(req)
  defer res.Body.Close()
  body, _ := ioutil.ReadAll(res.Body)

  fmt.Println(res)
  fmt.Println(string(body))
}

import requests

url = "https://example.com/auth/verify"
body = {
  "email": "user@example.com"
}
response = requests.request("POST", url, json = body, headers = {
  "Content-Type": "application/json"
})

print(response.text)

Empty

Get passkey registration options

Response Body

curl -X POST "https://example.com/auth/passkeys/register/options"

fetch("https://example.com/auth/passkeys/register/options")

package main

import (
  "fmt"
  "net/http"
  "io/ioutil"
)

func main() {
  url := "https://example.com/auth/passkeys/register/options"

  req, _ := http.NewRequest("POST", url, nil)
  
  res, _ := http.DefaultClient.Do(req)
  defer res.Body.Close()
  body, _ := ioutil.ReadAll(res.Body)

  fmt.Println(res)
  fmt.Println(string(body))
}

import requests

url = "https://example.com/auth/passkeys/register/options"

response = requests.request("POST", url)

print(response.text)

Empty

Post Auth Passkeys Register Verify

Verify webauthn passkey registration.

Request Body

application/jsonRequired

namestring

idRequiredstring

rawIdRequiredstring

responseRequiredobject

authenticatorAttachmentRequiredunknown

clientExtensionResultsunknown

typeRequiredstring

Response Body

curl -X POST "https://example.com/auth/passkeys/register/verify" \
  -H "Content-Type: application/json" \
  -d '{
    "name": "string",
    "id": "string",
    "rawId": "string",
    "response": {
      "clientDataJSON": "string",
      "attestationObject": "string",
      "authenticatorData": "string",
      "transports": null,
      "publicKeyAlgorithm": null,
      "publicKey": "string"
    },
    "authenticatorAttachment": null,
    "clientExtensionResults": null,
    "type": "string"
  }'

const body = JSON.stringify({
  "name": "string",
  "id": "string",
  "rawId": "string",
  "response": {
    "clientDataJSON": "string",
    "attestationObject": "string",
    "authenticatorData": "string",
    "transports": null,
    "publicKeyAlgorithm": null,
    "publicKey": "string"
  },
  "authenticatorAttachment": null,
  "clientExtensionResults": null,
  "type": "string"
})

fetch("https://example.com/auth/passkeys/register/verify", {
  body
})

package main

import (
  "fmt"
  "net/http"
  "io/ioutil"
  "strings"
)

func main() {
  url := "https://example.com/auth/passkeys/register/verify"
  body := strings.NewReader(`{
    "name": "string",
    "id": "string",
    "rawId": "string",
    "response": {
      "clientDataJSON": "string",
      "attestationObject": "string",
      "authenticatorData": "string",
      "transports": null,
      "publicKeyAlgorithm": null,
      "publicKey": "string"
    },
    "authenticatorAttachment": null,
    "clientExtensionResults": null,
    "type": "string"
  }`)
  req, _ := http.NewRequest("POST", url, body)
  req.Header.Add("Content-Type", "application/json")
  res, _ := http.DefaultClient.Do(req)
  defer res.Body.Close()
  body, _ := ioutil.ReadAll(res.Body)

  fmt.Println(res)
  fmt.Println(string(body))
}

import requests

url = "https://example.com/auth/passkeys/register/verify"
body = {
  "name": "string",
  "id": "string",
  "rawId": "string",
  "response": {
    "clientDataJSON": "string",
    "attestationObject": "string",
    "authenticatorData": "string",
    "transports": null,
    "publicKeyAlgorithm": null,
    "publicKey": "string"
  },
  "authenticatorAttachment": null,
  "clientExtensionResults": null,
  "type": "string"
}
response = requests.request("POST", url, json = body, headers = {
  "Content-Type": "application/json"
})

print(response.text)

Empty

Get passkey authentication options

Response Body

curl -X POST "https://example.com/auth/passkeys/authenticate/options"

fetch("https://example.com/auth/passkeys/authenticate/options")

package main

import (
  "fmt"
  "net/http"
  "io/ioutil"
)

func main() {
  url := "https://example.com/auth/passkeys/authenticate/options"

  req, _ := http.NewRequest("POST", url, nil)
  
  res, _ := http.DefaultClient.Do(req)
  defer res.Body.Close()
  body, _ := ioutil.ReadAll(res.Body)

  fmt.Println(res)
  fmt.Println(string(body))
}

import requests

url = "https://example.com/auth/passkeys/authenticate/options"

response = requests.request("POST", url)

print(response.text)

Empty

Verify passkey authentication

Request Body

application/jsonRequired

idRequiredstring

rawIdRequiredstring

responseRequiredobject

typeRequiredstring

clientExtensionResultsRequiredunknown

authenticatorAttachmentRequiredstring

Response Body

curl -X POST "https://example.com/auth/passkeys/authenticate/verify" \
  -H "Content-Type: application/json" \
  -d '{
    "id": "string",
    "rawId": "string",
    "response": {
      "authenticatorData": "string",
      "clientDataJSON": "string",
      "signature": "string",
      "userHandle": "string"
    },
    "type": "string",
    "clientExtensionResults": null,
    "authenticatorAttachment": "string"
  }'

const body = JSON.stringify({
  "id": "string",
  "rawId": "string",
  "response": {
    "authenticatorData": "string",
    "clientDataJSON": "string",
    "signature": "string",
    "userHandle": "string"
  },
  "type": "string",
  "clientExtensionResults": null,
  "authenticatorAttachment": "string"
})

fetch("https://example.com/auth/passkeys/authenticate/verify", {
  body
})

package main

import (
  "fmt"
  "net/http"
  "io/ioutil"
  "strings"
)

func main() {
  url := "https://example.com/auth/passkeys/authenticate/verify"
  body := strings.NewReader(`{
    "id": "string",
    "rawId": "string",
    "response": {
      "authenticatorData": "string",
      "clientDataJSON": "string",
      "signature": "string",
      "userHandle": "string"
    },
    "type": "string",
    "clientExtensionResults": null,
    "authenticatorAttachment": "string"
  }`)
  req, _ := http.NewRequest("POST", url, body)
  req.Header.Add("Content-Type", "application/json")
  res, _ := http.DefaultClient.Do(req)
  defer res.Body.Close()
  body, _ := ioutil.ReadAll(res.Body)

  fmt.Println(res)
  fmt.Println(string(body))
}

import requests

url = "https://example.com/auth/passkeys/authenticate/verify"
body = {
  "id": "string",
  "rawId": "string",
  "response": {
    "authenticatorData": "string",
    "clientDataJSON": "string",
    "signature": "string",
    "userHandle": "string"
  },
  "type": "string",
  "clientExtensionResults": null,
  "authenticatorAttachment": "string"
}
response = requests.request("POST", url, json = body, headers = {
  "Content-Type": "application/json"
})

print(response.text)

Empty

List all passkeys for current user

Response Body

curl -X GET "https://example.com/auth/passkeys/"

fetch("https://example.com/auth/passkeys/")

package main

import (
  "fmt"
  "net/http"
  "io/ioutil"
)

func main() {
  url := "https://example.com/auth/passkeys/"

  req, _ := http.NewRequest("GET", url, nil)
  
  res, _ := http.DefaultClient.Do(req)
  defer res.Body.Close()
  body, _ := ioutil.ReadAll(res.Body)

  fmt.Println(res)
  fmt.Println(string(body))
}

import requests

url = "https://example.com/auth/passkeys/"

response = requests.request("GET", url)

print(response.text)

Empty

Response Body

curl -X POST "https://example.com/auth/passkeys/prf-assert/options"

fetch("https://example.com/auth/passkeys/prf-assert/options")

package main

import (
  "fmt"
  "net/http"
  "io/ioutil"
)

func main() {
  url := "https://example.com/auth/passkeys/prf-assert/options"

  req, _ := http.NewRequest("POST", url, nil)
  
  res, _ := http.DefaultClient.Do(req)
  defer res.Body.Close()
  body, _ := ioutil.ReadAll(res.Body)

  fmt.Println(res)
  fmt.Println(string(body))
}

import requests

url = "https://example.com/auth/passkeys/prf-assert/options"

response = requests.request("POST", url)

print(response.text)

Empty

Return WebAuthn authentication options to enable recovery on an already-registered passkey. Scoped to one credential; if the authenticator emits a PRF output, the client POSTs a new wrapped-K_m slot for it.

Path Parameters

credentialIdRequiredstring

Response Body

curl -X POST "https://example.com/auth/passkeys/string/prf-enroll/options"

fetch("https://example.com/auth/passkeys/string/prf-enroll/options")

package main

import (
  "fmt"
  "net/http"
  "io/ioutil"
)

func main() {
  url := "https://example.com/auth/passkeys/string/prf-enroll/options"

  req, _ := http.NewRequest("POST", url, nil)
  
  res, _ := http.DefaultClient.Do(req)
  defer res.Body.Close()
  body, _ := ioutil.ReadAll(res.Body)

  fmt.Println(res)
  fmt.Println(string(body))
}

import requests

url = "https://example.com/auth/passkeys/string/prf-enroll/options"

response = requests.request("POST", url)

print(response.text)

Empty

Delete a passkey

Path Parameters

passkeyIdRequiredstring

Response Body

curl -X DELETE "https://example.com/auth/passkeys/string"

fetch("https://example.com/auth/passkeys/string")

package main

import (
  "fmt"
  "net/http"
  "io/ioutil"
)

func main() {
  url := "https://example.com/auth/passkeys/string"

  req, _ := http.NewRequest("DELETE", url, nil)
  
  res, _ := http.DefaultClient.Do(req)
  defer res.Body.Close()
  body, _ := ioutil.ReadAll(res.Body)

  fmt.Println(res)
  fmt.Println(string(body))
}

import requests

url = "https://example.com/auth/passkeys/string"

response = requests.request("DELETE", url)

print(response.text)

Empty

Get all sessions for current user

Response Body

curl -X GET "https://example.com/auth/sessions/"

fetch("https://example.com/auth/sessions/")

package main

import (
  "fmt"
  "net/http"
  "io/ioutil"
)

func main() {
  url := "https://example.com/auth/sessions/"

  req, _ := http.NewRequest("GET", url, nil)
  
  res, _ := http.DefaultClient.Do(req)
  defer res.Body.Close()
  body, _ := ioutil.ReadAll(res.Body)

  fmt.Println(res)
  fmt.Println(string(body))
}

import requests

url = "https://example.com/auth/sessions/"

response = requests.request("GET", url)

print(response.text)

Empty

Post Auth Sessions

Request Body

application/jsonRequired

methodRequiredstring

emailRequiredstring

Format: "email"

tokenRequiredstring

Response Body

curl -X POST "https://example.com/auth/sessions/" \
  -H "Content-Type: application/json" \
  -d '{
    "method": "passkey",
    "email": "user@example.com",
    "token": "string"
  }'

const body = JSON.stringify({
  "method": "passkey",
  "email": "user@example.com",
  "token": "string"
})

fetch("https://example.com/auth/sessions/", {
  body
})

package main

import (
  "fmt"
  "net/http"
  "io/ioutil"
  "strings"
)

func main() {
  url := "https://example.com/auth/sessions/"
  body := strings.NewReader(`{
    "method": "passkey",
    "email": "user@example.com",
    "token": "string"
  }`)
  req, _ := http.NewRequest("POST", url, body)
  req.Header.Add("Content-Type", "application/json")
  res, _ := http.DefaultClient.Do(req)
  defer res.Body.Close()
  body, _ := ioutil.ReadAll(res.Body)

  fmt.Println(res)
  fmt.Println(string(body))
}

import requests

url = "https://example.com/auth/sessions/"
body = {
  "method": "passkey",
  "email": "user@example.com",
  "token": "string"
}
response = requests.request("POST", url, json = body, headers = {
  "Content-Type": "application/json"
})

print(response.text)

Empty

Delete Auth Sessions

Sign out a user.

Response Body

curl -X DELETE "https://example.com/auth/sessions/"

fetch("https://example.com/auth/sessions/")

package main

import (
  "fmt"
  "net/http"
  "io/ioutil"
)

func main() {
  url := "https://example.com/auth/sessions/"

  req, _ := http.NewRequest("DELETE", url, nil)
  
  res, _ := http.DefaultClient.Do(req)
  defer res.Body.Close()
  body, _ := ioutil.ReadAll(res.Body)

  fmt.Println(res)
  fmt.Println(string(body))
}

import requests

url = "https://example.com/auth/sessions/"

response = requests.request("DELETE", url)

print(response.text)

Empty

Delete Auth Sessions All

Sign out of every device. Destroys all session rows and rotates every per-device wrap secret so any cached seed envelope on any device is immediately unusable.

Response Body

curl -X DELETE "https://example.com/auth/sessions/all"

fetch("https://example.com/auth/sessions/all")

package main

import (
  "fmt"
  "net/http"
  "io/ioutil"
)

func main() {
  url := "https://example.com/auth/sessions/all"

  req, _ := http.NewRequest("DELETE", url, nil)
  
  res, _ := http.DefaultClient.Do(req)
  defer res.Body.Close()
  body, _ := ioutil.ReadAll(res.Body)

  fmt.Println(res)
  fmt.Println(string(body))
}

import requests

url = "https://example.com/auth/sessions/all"

response = requests.request("DELETE", url)

print(response.text)

Empty

Delete Auth Sessions Others

Sign out of every OTHER device. Keeps the caller's session and wrap secret intact; rotates every other device's wrap secret and deletes every other session row.

Request Body

application/jsonRequired

deviceIdRequiredstring

Minimum length: 8Maximum length: 64Pattern: "^[a-zA-Z0-9-]+$"

Response Body

curl -X DELETE "https://example.com/auth/sessions/others" \
  -H "Content-Type: application/json" \
  -d '{
    "deviceId": "stringst"
  }'

const body = JSON.stringify({
  "deviceId": "stringst"
})

fetch("https://example.com/auth/sessions/others", {
  body
})

package main

import (
  "fmt"
  "net/http"
  "io/ioutil"
  "strings"
)

func main() {
  url := "https://example.com/auth/sessions/others"
  body := strings.NewReader(`{
    "deviceId": "stringst"
  }`)
  req, _ := http.NewRequest("DELETE", url, body)
  req.Header.Add("Content-Type", "application/json")
  res, _ := http.DefaultClient.Do(req)
  defer res.Body.Close()
  body, _ := ioutil.ReadAll(res.Body)

  fmt.Println(res)
  fmt.Println(string(body))
}

import requests

url = "https://example.com/auth/sessions/others"
body = {
  "deviceId": "stringst"
}
response = requests.request("DELETE", url, json = body, headers = {
  "Content-Type": "application/json"
})

print(response.text)

Empty

Get Auth Sessions Current

Response Body

curl -X GET "https://example.com/auth/sessions/current"

fetch("https://example.com/auth/sessions/current")

package main

import (
  "fmt"
  "net/http"
  "io/ioutil"
)

func main() {
  url := "https://example.com/auth/sessions/current"

  req, _ := http.NewRequest("GET", url, nil)
  
  res, _ := http.DefaultClient.Do(req)
  defer res.Body.Close()
  body, _ := ioutil.ReadAll(res.Body)

  fmt.Println(res)
  fmt.Println(string(body))
}

import requests

url = "https://example.com/auth/sessions/current"

response = requests.request("GET", url)

print(response.text)

Empty

Get current session permissions

Response Body

curl -X GET "https://example.com/auth/sessions/current/permissions"

fetch("https://example.com/auth/sessions/current/permissions")

package main

import (
  "fmt"
  "net/http"
  "io/ioutil"
)

func main() {
  url := "https://example.com/auth/sessions/current/permissions"

  req, _ := http.NewRequest("GET", url, nil)
  
  res, _ := http.DefaultClient.Do(req)
  defer res.Body.Close()
  body, _ := ioutil.ReadAll(res.Body)

  fmt.Println(res)
  fmt.Println(string(body))
}

import requests

url = "https://example.com/auth/sessions/current/permissions"

response = requests.request("GET", url)

print(response.text)

Empty

Delete a session

Path Parameters

sessionIdRequiredstring

Response Body

curl -X DELETE "https://example.com/auth/sessions/string"

fetch("https://example.com/auth/sessions/string")

package main

import (
  "fmt"
  "net/http"
  "io/ioutil"
)

func main() {
  url := "https://example.com/auth/sessions/string"

  req, _ := http.NewRequest("DELETE", url, nil)
  
  res, _ := http.DefaultClient.Do(req)
  defer res.Body.Close()
  body, _ := ioutil.ReadAll(res.Body)

  fmt.Println(res)
  fmt.Println(string(body))
}

import requests

url = "https://example.com/auth/sessions/string"

response = requests.request("DELETE", url)

print(response.text)

Empty