PRIVATEAuthentication
Authentication
postAccept Invitation
Accepts an organisation invitation, linking an IDP connection to the pending user. Requires a valid signup_token from HandleLogin and an invitation_token from the invitation email. **Authentication:** None required (tokens required)
postGet Redirect URLs
Returns OAuth redirect URLs for configured identity providers for an application. Map keys are IDP slugs. **Authentication:** None required
postHandle Login
Processes the OAuth callback from an identity provider. Returns a login token (existing user), a signup token (new user), or an mfa challenge token (existing user with org-account 2FA). **Authentication:** None required
postHandle Signup
Completes the signup process for new users by setting their username. Requires a valid signup token from HandleLogin. **Authentication:** None required (signup token required)
postBegin Passkey Login
Starts a WebAuthn passkey login: returns PublicKeyCredentialRequestOptions for a discoverable (usernameless) assertion plus a session id. The org is taken from the X-Xeonr-Auth-Org-Id header and the RP ID is derived from its domain. **Authentication:** None required
postComplete Passkey Login
Verifies a WebAuthn assertion, resolves the org-account user (asserting it belongs to the request org), and mints the portal token. A passkey satisfies MFA, so no step-up is required. **Authentication:** None required (session id required)
postRefresh Session
Exchanges a long-lived session token for a fresh short-lived access token, sliding the session's expiry. Lets IdP/social and just-signed-up users keep a long persistent session without re-authenticating, mirroring the password 'remember me' flow. **Authentication:** None required (session token required)
postResolve Organisation
Resolves organisation metadata and public identity providers by domain or hostname. **Authentication:** None required
postVerify MFA Challenge
Completes a login held by org-account 2FA: validates the TOTP or recovery code against the challenge token from HandleLogin and returns the portal token. **Authentication:** None required (challenge token required)