Sign in

v10

latestOpenAPI 3.0.0raw.githubusercontent.com2026-07-0582185581.9 KB
User Account

Authenticate user with credentials

Authenticate a user using the specified method and credentials. Requires a valid session token from /initAuth.

Credential Formats by Method:

  • password: { "credentials": { "password": "your-password" } }
  • otp: { "credentials": { "otp": "123456" } } (6-digit code, valid for 10 minutes)
  • google: { "credentials": "google-id-token-string" }
  • microsoft: { "credentials": { "accessToken": "...", "idToken": "..." } }
  • azureAd: { "credentials": { "accessToken": "...", "idToken": "..." } }
  • oauth: { "credentials": { "accessToken": "...", "idToken": "..." } }
  • samlSso: Handled via redirect flow (use /saml/signIn instead)

Multi-Step Response:

If organization uses MFA, successful authentication returns:

  • status: "success" with nextStep and allowedMethods for next step

Fully Authenticated Response:

After completing all steps:

  • message: "Fully authenticated" with accessToken (1hr) and refreshToken (7d)

Security:

  • Account locks after 5 consecutive failed attempts
  • CAPTCHA may be required if enabled (pass cf-turnstile-response)
post/userAccount/authenticate

Headers

x-session-tokenstring required

Session token received from /initAuth endpoint

Request body

method'samlSso' | 'otp' | 'password' | 'google' | 'microsoft' | 'azureAd' | 'oauth' required

Authentication method to use

emailstring email

Optional email for verification (used with some OAuth methods)

cf-turnstile-responsestring

Cloudflare Turnstile CAPTCHA token (optional, if CAPTCHA is enabled)

Example request

{
  "credentials": {
    "otp": "123456"
  }
}

Response

Authentication step successful or fully authenticated

OR

Example response

{
  "message": "Fully authenticated"
}