TrieOH
IdentityXAPIAuthn

Log in a user

Logs in the specified credentials if they exist on the requested target (IdentityX itself, or the project identified by `project_id`). Returns an access/refresh token pair. The access token is an Ed25519-signed JWT; verify it against `/.well-known/jwks.json`.

POST/auth/login

Logs in the specified credentials if they exist on the requested target (IdentityX itself, or the project identified by project_id). Returns an access/refresh token pair. The access token is an Ed25519-signed JWT; verify it against /.well-known/jwks.json.

Query Parameters

project_id?string

Project to scope the operation to. Omit for IdentityX itself.

Request Body

application/json

TypeScript Definitions

Use the request body type in TypeScript.

Request body for /auth/setup, /auth/register, and /auth/login. Mirrors models.IDXRegisterRequest / models.IDXLoginRequest.

Response Body

application/json

application/problem+json

application/problem+json

application/problem+json

application/problem+json

curl -X POST "https://example.com/auth/login" \  -H "Content-Type: application/json" \  -d '{    "email": "user@example.com",    "password": "S3curePassw0rd!"  }'
{
  "access_token": "<access token, a JWT>",
  "refresh_token": "<refresh token, a JWT>",
  "access_expires_at": "2026-01-01T13:00:00Z",
  "refresh_expires_at": "2026-01-08T12:00:00Z",
  "domain": "example.com"
}
{
  "detail": "string",
  "instance": "../dictionary",
  "errors": [
    {
      "field": "string",
      "message": "string"
    }
  ],
  "type": "http://example.com",
  "status": 400,
  "title": "Validation Failed"
}
{
  "detail": "string",
  "instance": "../dictionary",
  "errors": [
    {
      "field": "string",
      "message": "string"
    }
  ],
  "type": "http://example.com",
  "status": 401,
  "title": "Unauthenticated"
}
{
  "detail": "string",
  "instance": "../dictionary",
  "errors": [
    {
      "field": "string",
      "message": "string"
    }
  ],
  "type": "http://example.com",
  "status": 500,
  "title": "Internal Server Error"
}
{
  "detail": "string",
  "instance": "../dictionary",
  "errors": [
    {
      "field": "string",
      "message": "string"
    }
  ],
  "type": "http://example.com",
  "status": 503,
  "title": "Identity Unavailable"
}

Set a new password with a reset link POST

Redeems the single-use JWT carried by a password-reset email and replaces the actor's password. The token is HMAC-signed, purpose-scoped, expires after a short TTL, and is consumed on first use — a consumed token is dead and a new link must be requested.

Log out a user POST

Logs out the current session, blacklisting the presented access and refresh tokens. Requires a valid bearer token; the tokens to blacklist are read from the request headers.