API ReferenceAuth

Start social sign-in

Mints a single-use `state` and returns the provider's authorize URL for the browser to navigate to. Returns JSON rather than a 302 because the caller is an XHR — a redirect would be followed by the fetch, not the window.

POST
/{appUid}/auth/oauth/{provider}/start

Path Parameters

provider*string

Provider slug from GET /auth/methods (e.g. google, github)

appUid*string

Your app's unique id. Find it in the console under the app's Settings, or in the URL of any app page.

Formatuuid

Request Body

application/json

TypeScript Definitions

Use the request body type in TypeScript.

Response Body

application/json

application/json

application/json

application/json

application/json

curl -X POST "https://example.com/497f6eca-6276-4993-bfeb-53cbbbba6f08/auth/oauth/string/start" \  -H "Content-Type: application/json" \  -d '{}'
{  "authorizeUrl": "string"}

Sign in with a code

Pairs the requestId with the emailed code. A wrong code costs one attempt but does NOT consume the request, so a typo does not force a new code; exhausting the attempt budget revokes it.

Finish social sign-in

The provider callback redirects the browser back with a two-minute single-use hand-off code — never a JWT, which in a URL would land in browser history, referrer headers and proxy logs. This trades that code for the real session, and only the app it was minted for may redeem it.