Authentication

Public. Which sign-in options a login / sign-up page should show.

Creates a (non-admin) account. Requires email/password sign-up to be enabled (403 otherwise) and the instance to be set up. Limited to 5 attempts per IP per minute. The operator may block disposable domains, certain domains and + aliases (400), and may require a Cloudflare Turnstile token (see GET /api/auth/methods).

• When email verification is required, the response is {"verification_required": true, "email": …} and a link plus a 6-digit code are emailed; continue with POST /api/auth/verify-email. The same response is returned if the address is already registered, so the form reveals nothing.
• Otherwise the response is {"token": …} — a session token; the user is signed in.

Checks the password and returns one of three shapes:

1. {"token": "<jwt>"} — signed in. Send Authorization: Bearer <jwt> on Dashboard requests. Sessions last 7 days and end early when the password is changed, 2FA is turned on or off, or the account is suspended.
2. {"verification_required": true, "email": "…"} — the email isn't verified yet (only shown after a correct password). Continue with POST /api/auth/verify-email or POST /api/auth/resend-verification.
3. {"mfa": {"token": "<mfa_token>", "setup": <bool>}} — a second factor is needed (always for admins, and for users who turned 2FA on). The challenge is valid for 10 minutes and allows 5 wrong codes.
   • setup: false → ask for a 6-digit authenticator code (or a recovery code) and call POST /api/auth/mfa/verify with {mfa_token, code}; it returns {"token": …}.
   • setup: true (an admin without 2FA) → call POST /api/auth/mfa/setup with {mfa_token} to get the secret / QR code, then POST /api/auth/mfa/verify with the first code; it returns {"token": …, "recovery_codes": [...]}.

Wrong email and wrong password both return 401 "wrong email or password". Limited to 30 attempts per IP and 10 per email per minute. A Turnstile token is required when enabled.

For an MFA challenge with setup: true. Returns a new TOTP secret as text, otpauth:// URI and SVG QR code. Repeated calls during the same sign-in return the same secret. Finish with POST /api/auth/mfa/verify.

Second sign-in step. code is a 6-digit TOTP code, or (when not enrolling) a single-use recovery code. When the challenge had setup: true, this also turns 2FA on and returns the recovery codes once. After 5 wrong codes the challenge ends and the user must sign in again. Limited to 10 attempts per user per minute.

Confirms the address with either the token from the emailed link (the link carries it in the URL fragment: '/verify-email#token=…) or the email plus the 6-digit code from the email. Links are' valid for 24 hours; a code dies after 5 wrong guesses. Limited to 20 attempts per IP per minute.

Users without 2FA are signed in (token is included). Admins and users with 2FA get only {"verified": true} and then sign in normally.

Sends a fresh verification link and code (earlier ones stop working) if the address belongs to an unverified, active account. Always answers {"ok": true} so it reveals nothing about which addresses exist. Limited to 5 per IP and 2 per address per minute; Turnstile token when enabled.

Emails a reset link (/reset-password#token=…, valid for 1 hour) if the address belongs to an active account. Always answers {"ok": true}. Returns 403 when the instance has no working email. Same rate limits and Turnstile rule as resend-verification.

Sets the new password using the token from the reset link. Does not sign in; all existing sessions end and the user signs in with the new password. Also marks the email as verified. Minimum 8 characters (10 for admins). Limited to 10 attempts per IP per minute.

Browser navigation endpoint (not for fetch). Redirects to Google's consent screen (OAuth 2.0 authorization code + PKCE). The flow must be finished within 10 minutes. Google then returns to GET /api/auth/google/callback.

Called by Google, not by your code. Always redirects back to the site's public URL:

• /auth/callback#token=<jwt> — signed in (the token is in the URL fragment, never sent to servers).
• /auth/callback#mfa=<mfa_token>&setup=<true|false> — continue with the two-factor step (see POST /api/auth/login).
• /login?error=<code> — failure; code is one of google_cancelled, google_failed, google_disabled, google_expired, google_unverified, account_disabled, signup_disabled, email_not_allowed.

An existing account with the same (Google-verified) email is linked; otherwise a new account is created when registration is enabled.