API ReferenceAuth

Turn a sign-in method on or off

Turns a single sign-in method on or off for the CALLER's own account. A switched-off method stays linked — the provider subject remains claimed and it can be switched back on — but no sign-in may come through it, enforced at each door rather than in the UI. Refuses to switch off the LAST enabled method, which would lock the owner out with no recovery path. Idempotent: setting a method to the state it already has succeeds without changing anything.

PATCH
/{appUid}/auth/identities/{identityUid}

Authorization

bearerAuth
AuthorizationBearer <token>

Authorization for API

In: header

Path Parameters

identityUid*string

methodId from GET /auth/identities — an identity uid, password, or an unlinked door's provider name

appUid*string

Your app's unique id. Find it in the console under the app's Settings, or in the URL of any app page.

Formatuuid

Request Body

application/json

TypeScript Definitions

Use the request body type in TypeScript.

Response Body

application/json

application/json

application/json

application/json

application/json

curl -X PATCH "https://example.com/497f6eca-6276-4993-bfeb-53cbbbba6f08/auth/identities/string" \  -H "Content-Type: application/json" \  -d '{    "enabled": true  }'
{  "methods": [    {      "kind": "string",      "identityUid": "string",      "methodId": "string",      "enabled": true,      "createdAt": "string"    }  ]}

List your sign-in methods

The methods linked to the CALLER's account, unioning the password on the account row with the federated/passwordless identities. Scoped to the caller from the verified session, never from a payload.

Remove a sign-in method

Unlinks one provider identity. Refuses to remove the LAST way in — unlinking the only provider on an account with no password would lock the owner out with no recovery path. Hard-deletes, so the same provider account can be linked again later.