# How a person can sign in

GET

/v1/auth/sign-in-options

```sh
curl --request GET \
  --url https://example.com/v1/auth/sign-in-options
```

Public: nobody is signed in yet. With `email`, the ways in for that email’s domain: the identity providers of the one tenant the domain is verified for (an unverified domain offers none), then any the deployment offers everyone it has added (`owner: deployment`, “Continue with Google”); without, an empty list: sign-in is email first, so nothing is offered before an email. `methods` says which ways in the deployment allows: identity providers, an API token (`POST /v1/auth/token-sign-in`), and an emailed sign-in link (`emailLink`, with a captcha site key when it needs one); `identityProviders` and `apiToken` both `false` when nobody can sign in to the console. Always mounted. The answer depends only on the domain: two people at the same domain get the same answer, whether or not either has an account. Rate-limited per client (`429 rate-limit-exceeded`, with `Retry-After`).

## Parameters

### Query Parameters

**email**

string

\>= 3 characters

The email the person typed; only its domain is used.

## Responses

### 200

The ways to sign in (possibly none).

application/json

object

**data**

required

Array\<object>

One way to sign in, as a sign-in page shows it.

object

**providerId**

required

string

\>= 1 characters

**displayName**

required

“Sign in with …”.

string

\>= 1 characters

**signInUrl**

required

Where the browser goes to start signing in with this provider.

string

**owner**

Whose it is: a workspace’s own identity provider (`tenant`), or one the deployment offers everyone it has added (“Continue with Google”, `deployment`). A sign-in page shows a workspace’s own first. Absent: `tenant`.

string

Allowed values: tenant deployment

**methods**

The ways in this deployment allows, for a sign-in page to show. Absent from older servers.

object

**identityProviders**

required

Sign-in with an organization’s identity provider (email first).

boolean

**apiToken**

required

Sign-in to the console with an API token (`POST /v1/auth/token-sign-in`).

boolean

**sessionCookie**

The browser session cookie’s kind: `secure` (`Secure` and `__Host-`, kept by browsers only over https, and by some on [http://localhost](http://localhost/)), or `plain` (development on a loopback address only, so every browser keeps it there). A sign-in page can check the browser keeps that kind before offering sign-in. Absent from older servers, and where there are no browser sessions: treat as `secure`.

string

Allowed values: secure plain

**emailLink**

Present when the deployment emails sign-in links: a sign-in page offers “Email me a sign-in link”. With `captchaSiteKey`, the request needs a Cloudflare Turnstile token (`x-captcha-response`).

object

**captchaSiteKey**

string

\>= 1 characters

**legal**

The deployment’s terms and privacy policy, for a sign-in page to link: only the ones its operator set, each an absolute https URL with no username or password. Absent when neither is set, and from older servers.

object

**termsUrl**

Its terms.

string format: uri

**privacyUrl**

Its privacy policy.

string format: uri

##### Example

```json
{
  "data": [
    {
      "owner": "tenant"
    }
  ],
  "methods": {
    "sessionCookie": "secure"
  }
}
```

### 400

`email` is not an email address.

application/json

object

**error**

required

object

**code**

required

Stable machine-readable discriminant. Values match domain error codes (see `docs/API-ROUTE-CONVENTIONS.md` §4.3).

string

**message**

required

string

**details**

Optional, kind-specific.

object

**_key_**

additional properties

any

**requestId**

required

Server-assigned request id; also echoed via `X-Request-Id` header.

string

##### Examplegenerated

```json
{
  "error": {
    "code": "example",
    "message": "example",
    "details": {},
    "requestId": "example"
  }
}
```

### 429

Too many lookups from this client.

application/json

object

**error**

required

object

**code**

required

Stable machine-readable discriminant. Values match domain error codes (see `docs/API-ROUTE-CONVENTIONS.md` §4.3).

string

**message**

required

string

**details**

Optional, kind-specific.

object

**_key_**

additional properties

any

**requestId**

required

Server-assigned request id; also echoed via `X-Request-Id` header.

string

##### Examplegenerated

```json
{
  "error": {
    "code": "example",
    "message": "example",
    "details": {},
    "requestId": "example"
  }
}
```

## See also

- [Operate a self-hosted runtime](https://docs.kindgi.com/v0.1.9/deploy/self-hosted/operate.md)
- [Kindgi 0.1.9](https://docs.kindgi.com/v0.1.9/releases/0.1.9.md)
- [Every error code](https://docs.kindgi.com/v0.1.9/reference/errors.md)