Skip to content
Kindgi

How a person can sign in

GET
/v1/auth/sign-in-options
curl --request GET \
  --url https://example.com/v1/auth/sign-in-options

Public: nobody is signed in yet. With email, the ways in for that email’s domain: the identity providers of the one tenant the domain is verified for (an unverified domain offers none), then any the deployment offers everyone it has added (owner: deployment, “Continue with Google”); without, an empty list: sign-in is email first, so nothing is offered before an email. methods says which ways in the deployment allows: identity providers, an API token (POST /v1/auth/token-sign-in), and an emailed sign-in link (emailLink, with a captcha site key when it needs one); identityProviders and apiToken both false when nobody can sign in to the console. Always mounted. The answer depends only on the domain: two people at the same domain get the same answer, whether or not either has an account. Rate-limited per client (429 rate-limit-exceeded, with Retry-After).

Parameters

Section titled “Parameters”

Query Parameters

Section titled “Query Parameters”
email
string
>= 3 characters

The email the person typed; only its domain is used.

Responses

Section titled “Responses”

200

Section titled “200”

The ways to sign in (possibly none).

Media typeapplication/json
object
data
required
Array<object>

One way to sign in, as a sign-in page shows it.

object
providerId
required
string
>= 1 characters
displayName
required

“Sign in with …”.

string
>= 1 characters
signInUrl
required

Where the browser goes to start signing in with this provider.

string
owner

Whose it is: a workspace’s own identity provider (tenant), or one the deployment offers everyone it has added (“Continue with Google”, deployment). A sign-in page shows a workspace’s own first. Absent: tenant.

string
Allowed values: tenant deployment
methods

The ways in this deployment allows, for a sign-in page to show. Absent from older servers.

object
identityProviders
required

Sign-in with an organization’s identity provider (email first).

boolean
apiToken
required

Sign-in to the console with an API token (POST /v1/auth/token-sign-in).

boolean
sessionCookie

The browser session cookie’s kind: secure (Secure and __Host-, kept by browsers only over https, and by some on http://localhost), or plain (development on a loopback address only, so every browser keeps it there). A sign-in page can check the browser keeps that kind before offering sign-in. Absent from older servers, and where there are no browser sessions: treat as secure.

string
Allowed values: secure plain
emailLink

Present when the deployment emails sign-in links: a sign-in page offers “Email me a sign-in link”. With captchaSiteKey, the request needs a Cloudflare Turnstile token (x-captcha-response).

object
captchaSiteKey
string
>= 1 characters
Example
{
  "data": [
    {
      "owner": "tenant"
    }
  ],
  "methods": {
    "sessionCookie": "secure"
  }
}

400

Section titled “400”

email is not an email address.

Media typeapplication/json
object
error
required
object
code
required

Stable machine-readable discriminant. Values match domain error codes (see docs/API-ROUTE-CONVENTIONS.md §4.3).

string
message
required
string
details

Optional, kind-specific.

object
key
additional properties
any
requestId
required

Server-assigned request id; also echoed via X-Request-Id header.

string
Examplegenerated
{
  "error": {
    "code": "example",
    "message": "example",
    "details": {},
    "requestId": "example"
  }
}

429

Section titled “429”

Too many lookups from this client.

Media typeapplication/json
object
error
required
object
code
required

Stable machine-readable discriminant. Values match domain error codes (see docs/API-ROUTE-CONVENTIONS.md §4.3).

string
message
required
string
details

Optional, kind-specific.

object
key
additional properties
any
requestId
required

Server-assigned request id; also echoed via X-Request-Id header.

string
Examplegenerated
{
  "error": {
    "code": "example",
    "message": "example",
    "details": {},
    "requestId": "example"
  }
}