Auth API

Sign-up to sign-out, plus the secret-key admin endpoints.

Base: https://cloud.flaresinc.com/v1/projects/{project}/auth. Every endpoint needs a project key; the ones marked secret refuse a public key. All of them 404 while Auth is not enabled for the project.

Client endpoints (public key)

Method	Path	Body	Returns
POST	`/signup`	`email`, `password`, `display_name?`	Session (201)
POST	`/signin`	`email`, `password`	Session
POST	`/otp/request`	`email`	`{sent:true}` — always
POST	`/otp/redeem`	`email`, `code`	Session
POST	`/refresh`	`refresh_token`	Session (rotated)
POST	`/signout`	`refresh_token`	`{signed_out:true}`
POST	`/signout-all`	— (access token header)	`{signed_out:true, everywhere:true}`
GET	`/user`	— (access token header)	`{user}`
POST	`/verify/request`	— (access token header)	`{sent:true}`
POST	`/verify/confirm`	`token`	`{verified:true, user}`
POST	`/password/forgot`	`email`	`{sent:true}` — always
POST	`/password/reset`	`token`, `password`	`{reset:true}`

The session object

{
  "user": { "id": "usr_…", "email": "aisha@example.com", "email_verified": false,
            "display_name": null, "photo_url": null, "status": "active",
            "has_password": true, "metadata": {}, "last_sign_in_at": "…", "created_at": "…" },
  "access_token": "eyJ…",
  "expires_at": "2026-09-09T18:00:00+00:00",
  "expires_in": 3600,
  "refresh_token": "frt_…"
}

Send access_token as X-Flares-User-Token (Auth, Functions) or X-Basket-User-Token (Basket). Store refresh_token securely — and replace it on every refresh. Rotation →

Worked example

curl -X POST -H 'Authorization: Bearer basket_public_…' -H 'Content-Type: application/json' \
  -d '{"email":"aisha@example.com","password":"a-strong-passphrase"}' \
  https://cloud.flaresinc.com/v1/projects/prj_…/auth/signin

# 200 → session
# 401 { "error": "unauthorized", "message": "Those credentials did not match." }
#     — the same answer for a wrong password, an unknown email and a disabled account

Admin endpoints (secret key)

Method	Path	Does
GET	`/users?search=&limit=&offset=`	List the pool with a total.
POST	`/users`	Create a user (`email`, `password?`, `display_name?`, `email_verified?`).
PATCH	`/users/{user}`	`{status:"active"\|"disabled"}`. Disabling also revokes their sessions.
DELETE	`/users/{user}`	Delete the identity.
POST	`/users/{user}/revoke-sessions`	Sign them out everywhere.
POST	`/users/{user}/send-reset`	Email a reset link.

No endpoint returns a password or a hash, in any form, for any key. Security model →