Sessions

Password login and browser session lifecycle.

38 operations

• POST/api/auth/email/confirmConfirm an email-verification token
• POST/api/auth/email/send-verificationSend (or resend) the email verification link
• GET/api/auth/handle-availabilityCheck whether a signup username is free, taken, or GitHub-claimable
• POST/api/auth/login/challenge/totpComplete a TOTP login challenge
• POST/api/auth/login/passkey/finishComplete a passwordless passkey login
• POST/api/auth/login/passkey/startBegin a passwordless passkey login
• GET/api/auth/oauth/{provider}/callbackOAuth provider callback
• POST/api/auth/oauth/{provider}/elevateWiden the granted scope of an already-linked provider
• POST/api/auth/oauth/{provider}/linkBegin an OAuth handshake to link a provider to the current account
• POST/api/auth/oauth/{provider}/startBegin an OAuth handshake (login or handle claim)
• POST/api/auth/password/reset/confirmConsume a password-reset token + rotate the password
• POST/api/auth/password/reset/requestStart a password-reset flow
• GET/api/auth/password/reset/verifyPeek at a password-reset token without consuming it
• GET/api/auth/providersList configured OAuth providers
• POST/api/auth/sudo/passkey/finishGrant a sudo-mode window by proving a passkey
• POST/api/auth/sudo/passkey/startBegin a passkey sudo step-up
• POST/api/auth/sudo/passwordGrant a sudo-mode window by re-verifying the password
• POST/api/auth/sudo/totpGrant a sudo-mode window by verifying a TOTP or recovery code
• POST/api/auth/totp/confirmConfirm TOTP enrolment
• POST/api/auth/totp/disableDisable TOTP
• POST/api/auth/totp/enrollBegin TOTP enrolment
• POST/api/auth/totp/recovery-codes/regenerateRegenerate TOTP recovery codes
• GET/api/auth/webauthn/credentialsList this account's registered passkeys
• DELETE/api/auth/webauthn/credentials/{credential_id}Remove a passkey
• PATCH/api/auth/webauthn/credentials/{credential_id}Rename a passkey
• POST/api/auth/webauthn/register/finishComplete passkey registration
• POST/api/auth/webauthn/register/startBegin registering a passkey
• POST/api/loginLog in with username and password
• POST/api/sessionsCreate or refresh a browser session
• DELETE/api/sessionsDelete the current browser session
• POST/api/signupCreate a new user account
• GET/api/user/identitiesList linked OAuth identities
• DELETE/api/user/identities/{identity_id}Unlink an OAuth identity
• GET/api/user/meGet the current authenticated user
• PATCH/api/user/meUpdate the current user's account settings
• GET/api/user/sessionsList the caller's active sessions
• DELETE/api/user/sessionsLog out everywhere else
• DELETE/api/user/sessions/{session_id}Revoke a specific session