# Overview

## Auth

OIDC and SAML identity providers + session lifecycle. Layers browser-based auth on top of the static bearer-token surface: bearer tokens continue to work byte-shape-identical; session tokens use the `kgi_sk_*` prefix so the same middleware routes both flavors. Providers are caller-plugged via `IdentityProviderBinding` (no baked-in list); sign-in runs in the deployment, which reads them. Sessions persist via `SessionStoreBinding`. `clientSecretRef` is a REFERENCE — the plaintext secret never crosses the wire.

## Operations

GET

[/v1/auth/providers](https://docs.kindgi.com/v0.1.10/reference/api/operations/authproviderslist.md)

POST

[/v1/auth/providers](https://docs.kindgi.com/v0.1.10/reference/api/operations/authprovidersregister.md)

GET

[/v1/auth/sign-in-options](https://docs.kindgi.com/v0.1.10/reference/api/operations/authsigninoptions.md)

POST

[/v1/auth/token-sign-in](https://docs.kindgi.com/v0.1.10/reference/api/operations/authtokensignin.md)

GET

[/v1/auth/providers/{providerId}](https://docs.kindgi.com/v0.1.10/reference/api/operations/authprovidersget.md)

PATCH

[/v1/auth/providers/{providerId}](https://docs.kindgi.com/v0.1.10/reference/api/operations/authprovidersupdate.md)

GET

[/v1/auth/providers/{providerId}/sign-in](https://docs.kindgi.com/v0.1.10/reference/api/operations/authproviderssignin.md)

POST

[/v1/auth/providers/{providerId}/unregister](https://docs.kindgi.com/v0.1.10/reference/api/operations/authprovidersunregister.md)

GET

[/v1/auth/settings](https://docs.kindgi.com/v0.1.10/reference/api/operations/authsettingsget.md)

PATCH

[/v1/auth/settings](https://docs.kindgi.com/v0.1.10/reference/api/operations/authsettingsupdate.md)

POST

[/v1/auth/refresh](https://docs.kindgi.com/v0.1.10/reference/api/operations/authrefresh.md)

POST

[/v1/auth/logout](https://docs.kindgi.com/v0.1.10/reference/api/operations/authlogout.md)