AuthOS supplies APIs, hosted lite-client routes, and SDK adapters. Your product owns its application UI. The sequences below name only the AuthOS requests that participate in each journey; see the focused reference pages for payloads.
Password sign-in
- Register with
POST /api/auth/registeror sign in withPOST /api/auth/login. - When email verification is required, the emailed link reaches
GET /auth/verify-email. - When MFA is required, complete
POST /api/auth/mfa/verify. - Select a tenant with
POST /api/organizations/{org_slug}/selectwhen the session must be scoped to an organization. - Refresh with
POST /api/auth/refreshand end the session withPOST /api/auth/logout.
Store refresh tokens only in an appropriate secure store. Browser adapters must not expose service API keys or platform credentials.
OAuth sign-in
- Navigate to
GET /auth/{provider}with the required service and redirect context. - The provider returns to
GET /auth/{provider}/callback. - AuthOS validates state and exchanges the provider response before issuing the AuthOS session.
Admin-provider authorization uses the separate /auth/admin/{provider} route
pair. Do not interchange the two flows.
Passwordless sign-in
- Magic links begin with
POST /api/auth/magic-link/requestand are verified byGET /api/auth/magic-link/verify. - Passkey authentication uses
POST /api/auth/passkeys/authenticate/startfollowed byPOST /api/auth/passkeys/authenticate/finish.
Passkey enrollment is a separate authenticated user flow under
/api/auth/passkeys/register/*.
Device authorization
- The device requests a code with
POST /auth/device/code. - A user reviews the code through the hosted activation flow, which submits
POST /auth/device/verify. - The device polls
POST /auth/tokenuntil authorization succeeds, is denied, or expires.
The device code is not a bearer access token and must not be logged.
Tenant administration
An authenticated tenant administrator works through organization-scoped routes for members, services, roles, invitations, webhooks, SIEM, domains, and upstream providers. Every resource identifier is checked against the organization in the URL. A cross-tenant identifier is returned as not found rather than revealing ownership.
Service-to-service access
Backends authenticate with X-Api-Key only on the /api/service/* surface.
Service keys belong in server-side secret storage and must never be shipped in
React, Vue, browser, or mobile bundles.
Platform operation
Platform-owner routes live under /api/platform/* and are distinct from tenant
administration. Promotion, impersonation, bootstrap changes, and destructive
actions require their dedicated routes and authorization checks. Keep platform
credentials out of tenant tooling.
For the exhaustive method/path inventory, use the Complete Endpoint Catalog.