Sign-in methods
6 routes. Paths are relative to https://api.intersink.com/v1.
- POST/auth/web/login-passwordWeb: email + password → session cookies (or a pending second factor)
- POST/auth/web/login-totpWeb: email + authenticator code → session cookies
- POST/auth/web/mfa/otpWeb: finish sign-in with an emailed code
- POST/auth/web/mfa/passkey/verifyWeb: finish sign-in with a passkey
- POST/auth/web/mfa/totpWeb: finish sign-in with an authenticator code
- POST/auth/web/passkey/login/verifyWeb: passkey sign-in → session cookies
Web: email + password → session cookies (or a pending second factor)
POST/auth/web/login-password
Public: no sign-in needed.
Parameters
| Name | Type | Description |
|---|---|---|
| x-ref | string, header |
Request body application/json
| Field | Type | Description |
|---|---|---|
| string | Email or username (one of the two is required) Example: "user@example.com" | |
| username | string | Sign in with the username of the account's profile in this channel. Example: "riya_716" |
| passwordrequired | string | Example: "MyS3cret!" |
| device_id | string | Example: "iphone_15_pro" |
| channel_id | string | Example: "REF-A1" |
| captcha | string | Cloudflare Turnstile token, when the channel turns the check on (GET /auth/sign-in-options) At most 2048 characters. |
Response
200. The payload in data is of type object.
Web: email + authenticator code → session cookies
POST/auth/web/login-totp
Public: no sign-in needed.
Parameters
| Name | Type | Description |
|---|---|---|
| x-ref | string, header |
Request body application/json
| Field | Type | Description |
|---|---|---|
| emailrequired | string | Example: "user@example.com" |
| coderequired | string | Authenticator or backup code Example: "123456" |
| device_id | string | Example: "iphone_15_pro" |
| channel_id | string | Example: "REF-A1" |
| captcha | string | Cloudflare Turnstile token (channels with auth.captcha=turnstile; see GET /auth/sign-in-options) At most 2048 characters. |
Response
200. The payload in data is of type object.
Web: finish sign-in with an emailed code
POST/auth/web/mfa/otp
Public: no sign-in needed.
Request body application/json
| Field | Type | Description |
|---|---|---|
| pending_tokenrequired | string | The pending-login token from the first factor |
| otprequired | string | The emailed OTP Example: "123456" |
Response
200. The payload in data is of type object.
Web: finish sign-in with a passkey
POST/auth/web/mfa/passkey/verify
Public: no sign-in needed.
Request body application/json
| Field | Type | Description |
|---|---|---|
| pending_tokenrequired | string | The pending-login token from the first factor |
| responserequired | object | The WebAuthn assertion response |
Response
200. The payload in data is of type object.
Web: finish sign-in with an authenticator code
POST/auth/web/mfa/totp
Public: no sign-in needed.
Request body application/json
| Field | Type | Description |
|---|---|---|
| pending_tokenrequired | string | The pending-login token from the first factor |
| coderequired | string | Authenticator or backup code Example: "123456" |
Response
200. The payload in data is of type object.
Web: passkey sign-in → session cookies
POST/auth/web/passkey/login/verify
Public: no sign-in needed.
Parameters
| Name | Type | Description |
|---|---|---|
| x-ref | string, header |
Request body application/json
| Field | Type | Description |
|---|---|---|
| string | Example: "user@example.com" | |
| challenge_id | string | From passkey/login/options when no e-mail was given |
| responserequired | object | Assertion response from the authenticator |
| device_id | string | Example: "iphone_15_pro" |
| channel_id | string | Example: "REF-A1" |
Response
200. The payload in data is of type object.