List configured OAuth providers

GET/api/auth/providers

listAuthProviders

Returns provider slugs the SPA can offer as login buttons. Empty list means OAuth is not wired on this deployment.

Authentication is not described for this operation in the spec — that does not mean it is public. Check tokens and scopes.

curl

curl -X GET 'https://neosource.dev/api/auth/providers'

fetch

fetch("https://neosource.dev/api/auth/providers", {
  method: "GET",
});

Responses

application/json

AuthProvidersResponse

object

passkeys_enabledrequired: boolean
Whether this deployment has a usable `WebAuthn` relying party, i.e. whether the passkey routes will work at all. It rides on this response — rather than being probed — because the login page must decide whether to paint the "Sign in with a passkey" button at FIRST paint. This response is already seeded by the route's `load()`, so the decision is available synchronously and the button never appears a frame late (docs/frontend-design.md §"visible UI never moves"). Says nothing about the *browser*: that is a separate, synchronous capability check on the client.
providersrequired: array
Provider slugs that are configured on this deployment and available for the "Sign in with …" buttons.
items
string
signup_disabledrequired: boolean
When true, new-account signup is disabled (`NEOSOURCE_SIGNUP_DISABLED`). The SPA hides the signup form and the OAuth "create account" affordance; existing-account login still works.

Bodies documented once for the whole API — see standard errors.

429Rate limited — retry after the `Retry-After` header
500Internal server error
503Service temporarily unavailable / at capacity — retry after the `Retry-After` header
504Gateway timeout — the request exceeded the server's handling budget