Remove a linked sign-in method
Unlinks one provider identity. Refuses to remove the LAST way in — unlinking the only provider on an account with no password would lock the owner out with no recovery path. Hard-deletes, so the same provider account can be linked again later.
Authorization
bearerAuth Authorization for API
In: header
Path Parameters
identityUid from GET /auth/identities
Your app's unique id. Find it in the console under the app's Settings, or in the URL of any app page.
uuidResponse Body
application/json
application/json
application/json
application/json
application/json
curl -X DELETE "https://example.com/497f6eca-6276-4993-bfeb-53cbbbba6f08/auth/identities/string"{ "message": "Sign-in method removed"}Exchange a refresh token for a new pair
Trades the refresh token for a new access token AND a new refresh token. Refresh tokens are SINGLE-USE: the one you send stops working once exchanged, so always store the pair you get back. Presenting a refresh token that has already been exchanged ends the whole session (`SESSION_ENDED`, reason `reused`) — the server reads it as a stolen token. The one exception is a narrow grace window just after an exchange, so two tabs refreshing at the same moment both receive the same current pair; coordinate refreshes anyway. Pass `activeOrgUid` to switch the session into another organization you are an accepted member of. An `Authorization` header on this request is ignored.
Sign in with a 6-digit code
Pairs the requestId with the emailed code. A wrong code costs one attempt but does NOT consume the request, so a typo does not force a new code; exhausting the attempt budget revokes it.