Skip to content
Kindgi

How a person can sign in

View as Markdown
GET
/v1/auth/sign-in-options
curl --request GET \
  --url https://example.com/v1/auth/sign-in-options

Public: nobody is signed in yet. With email, the ways in for that email’s domain: the identity providers of the one tenant the domain is verified for (an unverified domain offers none), then any the deployment offers everyone it has added (owner: deployment, “Continue with Google”); without, an empty list: sign-in is email first, so nothing is offered before an email. methods says which ways in the deployment allows: identity providers, an API token (POST /v1/auth/token-sign-in), and an emailed sign-in link (emailLink, with a captcha site key when it needs one); identityProviders and apiToken both false when nobody can sign in to the console. Always mounted. The answer depends only on the domain: two people at the same domain get the same answer, whether or not either has an account. Rate-limited per client (429 rate-limit-exceeded, with Retry-After).

Parameters

Section titled “Parameters”

Query Parameters

Section titled “Query Parameters”
email
string
>= 3 characters

The email the person typed; only its domain is used.

Responses

Section titled “Responses”

200

Section titled “200”

The ways to sign in (possibly none).

Media typeapplication/json
object
data
required
Array<object>

One way to sign in, as a sign-in page shows it.

object
providerId
required
string
>= 1 characters
displayName
required

“Sign in with …”.

string
>= 1 characters
signInUrl
required

Where the browser goes to start signing in with this provider.

string
owner

Whose it is: a workspace’s own identity provider (tenant), or one the deployment offers everyone it has added (“Continue with Google”, deployment). A sign-in page shows a workspace’s own first. Absent: tenant.

string
Allowed values: tenant deployment
methods

The ways in this deployment allows, for a sign-in page to show. Absent from older servers.

object
identityProviders
required

Sign-in with an organization’s identity provider (email first).

boolean
apiToken
required

Sign-in to the console with an API token (POST /v1/auth/token-sign-in).

boolean
sessionCookie

The browser session cookie’s kind: secure (Secure and __Host-, kept by browsers only over https, and by some on http://localhost), or plain (development on a loopback address only, so every browser keeps it there). A sign-in page can check the browser keeps that kind before offering sign-in. Absent from older servers, and where there are no browser sessions: treat as secure.

string
Allowed values: secure plain
emailLink

Present when the deployment emails sign-in links: a sign-in page offers “Email me a sign-in link”. With captchaSiteKey, the request needs a Cloudflare Turnstile token (x-captcha-response).

object
captchaSiteKey
string
>= 1 characters
legal

The deployment’s terms and privacy policy, for a sign-in page to link: only the ones its operator set, each an absolute https URL with no username or password. Absent when neither is set, and from older servers.

object
termsUrl

Its terms.

string format: uri
privacyUrl

Its privacy policy.

string format: uri
Example
{
  "data": [
    {
      "owner": "tenant"
    }
  ],
  "methods": {
    "sessionCookie": "secure"
  }
}

400

Section titled “400”

email is not an email address.

Media typeapplication/json
object
error
required
object
code
required

Stable machine-readable discriminant. Values match domain error codes (see docs/API-ROUTE-CONVENTIONS.md §4.3).

string
message
required
string
details

Optional, kind-specific.

object
key
additional properties
any
requestId
required

Server-assigned request id; also echoed via X-Request-Id header.

string
Examplegenerated
{
  "error": {
    "code": "example",
    "message": "example",
    "details": {},
    "requestId": "example"
  }
}

429

Section titled “429”

Too many lookups from this client.

Media typeapplication/json
object
error
required
object
code
required

Stable machine-readable discriminant. Values match domain error codes (see docs/API-ROUTE-CONVENTIONS.md §4.3).

string
message
required
string
details

Optional, kind-specific.

object
key
additional properties
any
requestId
required

Server-assigned request id; also echoed via X-Request-Id header.

string
Examplegenerated
{
  "error": {
    "code": "example",
    "message": "example",
    "details": {},
    "requestId": "example"
  }
}

See also