List available sign-in methods
Which doors THIS deployment offers (password, magic link, email OTP, and the configured OAuth providers), plus whether each one may create an account. Unauthenticated so a sign-in page can render before anyone signs in. Describes configuration only — never anything about a particular account, which is what would enable enumeration.
Path Parameters
Your app's unique id. Find it in the console under the app's Settings, or in the URL of any app page.
uuidResponse Body
application/json
application/json
curl -X GET "https://example.com/497f6eca-6276-4993-bfeb-53cbbbba6f08/auth/methods"{ "password": true, "magicLink": true, "emailOtp": true, "oauth": [ "string" ], "signup": { "magicLink": true, "emailOtp": true, "oauth": true }}Exchange an OAuth hand-off code for a session
The provider callback redirects the browser back with a two-minute single-use hand-off code — never a JWT, which in a URL would land in browser history, referrer headers and proxy logs. This trades that code for the real session, and only the app it was minted for may redeem it.
List your own sign-in methods
The methods linked to the CALLER's account, unioning the password on the account row with the federated/passwordless identities. Scoped to the caller from the verified session, never from a payload.