Xeonr Developer Docs
API SpecificationPRIVATExeonr.auth.private.v1.PasswordService

Password Login

POST
/xeonr.auth.private.v1.PasswordService/PasswordLogin

Authenticates with email and password. Returns an exchange code for the HandleLogin flow. Email must be verified.

Authentication: None required

Protection: Rate limited; requires Cloudflare Turnstile token when the organisation enables it

Authorization

BearerAuth
AuthorizationBearer <token>

JWT access token for internal API access. Requires 'private' scope for most endpoints, 'admin' scope for administrative operations.

In: header

Header Parameters

Connect-Protocol-Version*number

Define the version of the Connect protocol

Value in1
Connect-Timeout-Ms?number

Define the timeout, in ms

Request Body

application/json

email?string

Email address

Formatemail
Lengthlength <= 255
password?string

Password

Length1 <= length <= 128
rememberMe?boolean

Whether to create a persistent session (remember me)

turnstileToken?string

Cloudflare Turnstile token for bot protection (verified when the org requires it)

[key: string]?never

Response Body

application/json

application/json

curl -X POST "https://auth.xeonr.io/xeonr.auth.private.v1.PasswordService/PasswordLogin" \  -H "Connect-Protocol-Version: 1" \  -H "Content-Type: application/json" \  -d '{}'
{
  "code": "550e8400-e29b-41d4-a716-446655440000",
  "sessionToken": "sess_abc123def456",
  "totpRequired": true,
  "totpChallengeToken": "totp_challenge_abc123"
}
{
  "code": "not_found",
  "message": "string",
  "details": [
    {
      "type": "string",
      "value": "string",
      "debug": {}
    }
  ]
}

Password Authorize POST

Validates password authorize request parameters and returns a callback redirect URL containing code/state. **Authentication:** None required

Password Signup POST

Creates a new password-based account. A verification email will be sent to confirm the email address. **Authentication:** None required **Protection:** Requires Cloudflare Turnstile token