Nhost authentication API declares
2 security schemes
for authenticating requests.
It accepts HTTP bearer tokens (BearerAuth).
It accepts HTTP bearer tokens (BearerAuthElevated).
BearerAuth — Bearer authentication with JWT access token. Used to authenticate requests to protected endpoints.
BearerAuthElevated — Bearer authentication that requires elevated permissions. Used for sensitive operations that may require additional security measures such as recent authentica…
Paths & Operations 19
Across 18 paths, the API surfaces 19 operations — 2 GET, 17 POST. Each is listed below with its method, path, parameters, and response codes.
authentication 19
User authentication operations including sign-in, sign-up, and various authentication methods (email/password, passwordless, OAuth, WebAuthn, MFA)
POST
/signin/anonymous
Sign in anonymously
signInAnonymousbody→ 200default
POST
/signin/email-password
Sign in with email and password
signInEmailPasswordbody→ 200default
POST
/signin/idtoken
Sign in with an ID token
signInIdTokenbody→ 200default
POST
/signin/mfa/totp
Verify TOTP for MFA
verifySignInMfaTotpbody→ 200default
POST
/signin/otp/email
Sign in with email OTP
signInOTPEmailbody→ 200default
POST
/signin/otp/email/verify
Verify email OTP
verifySignInOTPEmailbody→ 200default
POST
/signin/passwordless/email
Sign in with magic link email
signInPasswordlessEmailbody→ 200default
POST
/signin/passwordless/sms
Sign in with SMS OTP
signInPasswordlessSmsbody→ 200default
POST
/signin/passwordless/sms/otp
Verify SMS OTP
verifySignInPasswordlessSmsbody→ 200default
POST
/signin/pat
Sign in with Personal Access Token (PAT)
signInPATbody→ 200default
GET
/signin/provider/{provider}
Sign in with an OAuth2 provider
signInProvider8 params→ 302default
GET
/signin/provider/{provider}/callback
OAuth2 provider callback endpoint
signInProviderCallbackGet9 params→ 302default
POST
/signin/provider/{provider}/callback
OAuth2 provider callback endpoint (formpost)
signInProviderCallbackPost1 parambody→ 302default
POST
/signin/webauthn
Sign in with Webauthn
signInWebauthnbody→ 200default
POST
/signin/webauthn/verify
Verify Webauthn sign-in
verifySignInWebauthnbody→ 200default
POST
/signup/email-password
Sign up with email and password
signUpEmailPasswordbody→ 200default
POST
/signup/webauthn
Sign up with Webauthn
signUpWebauthnbody→ 200default
POST
/signup/webauthn/verify
Verify Webauthn sign-up
verifySignUpWebauthnbody→ 200default
POST
/user/deanonymize
Deanonymize an anonymous user
deanonymizeUserbody→ 200default
Schemas 50
The contract defines 50 schemas that model the data the API accepts and returns. The most detailed are User (14 properties), PublicKeyCredentialCreationOptions (11 properties), PublicKeyCredentialRequestOptions (7 properties), SignUpOptions (6 properties). Each schema is shown below with its type and property counts.
SessionPayload
object
Container for session information
1 property
UserEntity
object
3 properties3 required
CredentialAssertionResponse
object
6 properties4 required
URLEncodedBase64
string
Base64url-encoded binary data
SignInEmailPasswordResponse
object
Response for email-password authentication that may include a session or MFA challenge
2 properties
CredentialParameter
object
2 properties2 required
SignInIdTokenRequest
object
4 properties2 required
SignInWebauthnRequest
object
1 property
UserDeanonymizeRequest
object
5 properties2 required
RelyingPartyEntity
object
2 properties2 required
SignInPasswordlessEmailRequest
object
2 properties1 required
IdTokenProvider
string
PublicKeyCredentialRequestOptions
object
7 properties1 required
SignInWebauthnVerifyRequest
object
2 properties1 required
ConveyancePreference
string
The attestation conveyance preference
SignInPATRequest
object
1 property1 required
SignInMfaTotpRequest
object
2 properties2 required
OKResponse
string
CredentialPropertiesOutput
object
Credential properties extension output
1 property
SignInOTPEmailRequest
object
2 properties1 required
SignUpWebauthnRequest
object
2 properties1 required
AttestationFormat
string
The attestation statement format
MFAChallengePayload
object
Challenge payload for multi-factor authentication
1 property1 required
AuthenticatorAttachment
string
The authenticator attachment modality
CredentialCreationResponse
object
6 properties4 required
SignInPasswordlessSmsOtpResponse
object
2 properties
SignUpOptions
object
6 properties
SignInEmailPasswordRequest
object
Request to authenticate using email and password
2 properties2 required
AuthenticatorAttestationResponse
object
6 properties2 required
AuthenticatorSelection
object
4 properties
AuthenticationExtensionsClientOutputs
object
Map of extension outputs from the client
3 properties
CredentialType
string
The valid credential types
SignInAnonymousRequest
object
3 properties
SignInOTPEmailVerifyResponse
object
1 property
User
object
User profile and account information
14 properties11 required
SignUpWebauthnVerifyRequest
object
3 properties1 required
ErrorResponse
object
Standardized error response
3 properties3 required
Session
object
User authentication session containing tokens and user information
5 properties4 required
SignInPasswordlessSmsOtpRequest
object
2 properties2 required
PublicKeyCredentialDescriptor
object
3 properties2 required
ResidentKeyRequirement
string
The resident key requirement
PublicKeyCredentialCreationOptions
object
11 properties4 required
SignInPasswordlessSmsRequest
object
2 properties1 required
SignUpEmailPasswordRequest
object
Request to register a new user with email and password
3 properties2 required
AuthenticatorTransport
string
The authenticator transports that can be used
UserVerificationRequirement
string
A requirement for user verification for the operation
AuthenticatorAssertionResponse
object
4 properties3 required
AuthenticationExtensions
object
Additional parameters requesting additional processing by the client and authenticator
SignInOTPEmailVerifyRequest
object
2 properties2 required
PublicKeyCredentialHints
string
Hints to help guide the user through the experience
Specification
The full machine-readable OpenAPI contract behind this narrative.
