​

Authentication

Authentication endpoints handle user account management, session tokens, and OAuth flows. Most endpoints in this group do not require authentication, as they are used to establish credentials.

​

Authentication Methods

​

Endpoints

​

Account Management

​

OAuth

​

OAuth Flow

OAuth authentication follows a two-step process:

1. Get Authorization URL — Call the provider’s authorization endpoint to receive a redirect URL
2. Handle Callback — After the user authorizes with the provider, send the authorization code to the callback endpoint to receive a JWT token

OAuth users don’t need to verify their email separately. If a user with the same email already exists (registered via email/password), the accounts are linked.

​

Token Lifecycle

1. Register an account or sign in via OAuth
2. Verify your email (email/password only)
3. Log in to receive a JWT token
4. Include the token in subsequent API requests via the Authorization: Bearer <token> header
5. Tokens expire after 24 hours — log in again to obtain a new one

For API key-based authentication (no expiry), see Platform API Keys.