API Reference
auth
Purpose
Auth endpoints and helpers handle authentication (e.g. JWT) and are required to access protected resources.
When to use
- Use JWT bearer tokens for server-to-server calls where possible.
- Rotate secrets and keep tokens short-lived; treat them as sensitive credentials.
Endpoints (19)
Click an endpoint to jump to its details.
/auth/device-biometric-loginLogin with device token (no WebAuthn). Use after local biometric unlock on mobile.
/auth/device-biometric-tokenIssue long-lived device token for biometric login (mobile without WebAuthn)
/auth/forgot-passwordRequest a password reset email. Works for existing users and for NEVER_LOGGED_IN (first-time set password).
/auth/googleLogin with Google credential
/auth/loginNo summary provided in OpenAPI spec.
/auth/login-activityGet recent login activity and anomaly summary
/auth/pinDisable PIN
/auth/pin/changeChange PIN (requires current PIN)
/auth/pin/request-resetRequest PIN reset (sends 6-digit OTP to email)
/auth/pin/resetReset PIN using OTP from email
/auth/pin/setSet 4-digit PIN for P2P and withdrawal step-up
/auth/registerNo summary provided in OpenAPI spec.
/auth/reset-passwordSet new password using the token from the email link. For NEVER_LOGGED_IN accounts this activates the account.
/auth/step-up/passkey-optionsGet WebAuthn options for step-up passkey verification
/auth/step-up/requiredCheck if step-up is required and which methods are available
/auth/step-up/verify-passkeyComplete step-up with passkey; returns step-up token
/auth/step-up/verify-pinComplete step-up with PIN (valid only for P2P and withdrawal)
/auth/step-up/verify-totpComplete step-up with TOTP code; returns step-up token
/auth/suspend-activitiesSuspend withdrawals and transfers (one-time link from alert)
/auth/device-biometric-loginLogin with device token (no WebAuthn). Use after local biometric unlock on mobile.
No detailed description provided for this operation in the OpenAPI spec.
/auth/device-biometric-tokenIssue long-lived device token for biometric login (mobile without WebAuthn)
No detailed description provided for this operation in the OpenAPI spec.
/auth/forgot-passwordRequest a password reset email. Works for existing users and for NEVER_LOGGED_IN (first-time set password).
No detailed description provided for this operation in the OpenAPI spec.
/auth/googleLogin with Google credential
No detailed description provided for this operation in the OpenAPI spec.
/auth/loginEndpoint
No detailed description provided for this operation in the OpenAPI spec.
/auth/login-activityGet recent login activity and anomaly summary
No detailed description provided for this operation in the OpenAPI spec.
/auth/pinDisable PIN
No detailed description provided for this operation in the OpenAPI spec.
/auth/pin/changeChange PIN (requires current PIN)
No detailed description provided for this operation in the OpenAPI spec.
/auth/pin/request-resetRequest PIN reset (sends 6-digit OTP to email)
Rate and count limited. Min interval between resets and max resets per day apply.
/auth/pin/resetReset PIN using OTP from email
No detailed description provided for this operation in the OpenAPI spec.
/auth/pin/setSet 4-digit PIN for P2P and withdrawal step-up
PIN can be used in addition to 2FA or passkey only for P2P transfer and withdrawal. User can have both PIN and 2FA/passkey; client sends either.
/auth/registerEndpoint
No detailed description provided for this operation in the OpenAPI spec.
/auth/reset-passwordSet new password using the token from the email link. For NEVER_LOGGED_IN accounts this activates the account.
No detailed description provided for this operation in the OpenAPI spec.
/auth/step-up/passkey-optionsGet WebAuthn options for step-up passkey verification
Same as passkey login: returns challenge and options for navigator.credentials.get() (no device authorization required). Send the resulting assertion to POST /auth/step-up/verify-passkey.
/auth/step-up/requiredCheck if step-up is required and which methods are available
methods: passkey/2FA for all critical ops. methodsP2PWithdrawal: includes PIN (only valid for P2P and withdrawal).
/auth/step-up/verify-passkeyComplete step-up with passkey; returns step-up token
No detailed description provided for this operation in the OpenAPI spec.
/auth/step-up/verify-pinComplete step-up with PIN (valid only for P2P and withdrawal)
Returns step-up token. This token is accepted only by withdrawal and P2P transfer endpoints.
/auth/step-up/verify-totpComplete step-up with TOTP code; returns step-up token
No detailed description provided for this operation in the OpenAPI spec.
/auth/suspend-activitiesSuspend withdrawals and transfers (one-time link from alert)
No detailed description provided for this operation in the OpenAPI spec.