Auth

Sign-in and token refresh (JWT only)

📄️ Log in with email and password

Authenticates a user and issues an access/refresh token pair. Locks the account for a cooldown period after 5 consecutive failed password attempts. Set NotifyUser=false to suppress the 'new login detected' notification.

📄️ Verify the OTP for a pending two-factor login

Completes a two-step login by checking the OTP code against the pending login session, then issues an access/refresh token pair.

📄️ Resend the login OTP code

Generates a new OTP for a pending two-factor login session and re-sends it by email (and SMS if a phone number is on file).

📄️ Exchange a refresh token for a new access token

Issues a new access token (and rotates the refresh token) as long as the refresh token is valid and was not issued before the user's last logout.

📄️ Send a one-time verification code to an email

Used for both new-account email verification and password-reset flows, depending on the isResetPassword query flag.

📄️ Send a one-time verification code to an additional email

Sends an OTP to a secondary email address the logged-in user wants to add to their account, ahead of calling verify-email-additional-email.

📄️ Verify email OTP and activate a new account

Completes new-user registration: validates the OTP sent to the email, provisions payment/finance accounts for the user, and sends a welcome email.

📄️ Verify OTP for an additional email address

Confirms an OTP sent to a secondary email and adds it to the logged-in user's list of additional emails.

📄️ Request a password-reset code

Sends a one-time verification code to the given email to start the password-reset flow. An optional redirectUrl is remembered and returned by /auth/reset-password once the flow completes.

📄️ Reset a password using an OTP

Sets a new password after verifying the OTP sent via /auth/forgot-password (or /auth/send-otp).

📄️ Get the logged-in user's profile

Returns the current user's profile along with their effective permissions (used for client-side UI gating).

📄️ Log out the current session

Revokes the caller's current access and refresh tokens by recording a logout epoch; any token issued before this moment is rejected going forward.

📄️ Request an OTP to verify a phone number

Sends a 6-digit SMS OTP to the given phone number so the logged-in user can verify it.

📄️ Verify a phone number's OTP

Confirms the SMS OTP and marks the phone number as verified on the logged-in user's account.