Start passwordless sign in

Starts a sign in process by requesting a linkCode and a deviceId + userInputCode combination the user can use to sign in. Passing the optional deviceId signifies a resend code flow.

POST/appid-{appId}/{tenantId}/recipe/signinup/code

Authorization

api-keyAPI key · headerrequired

The core service API token. If you are using a self-hosted core service and you have not generated a token, you can omit the header.

Path parameters

tenantIdstring

The tenant against which the request is made. If left empty, the default tenant will be used.

Header parameters

ridstring

cdi-versionstring

X.Y of the X.Y.Z CDI version.

Request body

application/json

One of:

object

emailemailrequired

userInputCodeuserInputCode

This can be used to authenticate the user when paired with the deviceId

object

phoneNumberphoneNumberrequired

userInputCodeuserInputCode

This can be used to authenticate the user when paired with the deviceId

object

deviceIddeviceIdrequired

A random identifier that should be stored on the device that started the sign in process.

userInputCodeuserInputCode

This can be used to authenticate the user when paired with the deviceId

Responses

200Starts the passwordless login process

One of:

object

statusstatusOK

Allowed:OK

preAuthSessionIdpreAuthSessionId

A random identifier that can be used to identify the login attempt/device.

codeIdcodeId

Uniquely identifies a code

deviceIddeviceId

A random identifier that should be stored on the device that started the sign in process.

userInputCodeuserInputCode

This can be used to authenticate the user when paired with the deviceId

linkCodelinkCode

URL-safe string that can be used to authenticate the user, without the deviceId

timeCreatedtimeCreated

codeLifetimecodeLifetime

The maximum lifetime of the code in milliseconds

object

statusstring

Allowed:RESTART_FLOW_ERRORUSER_INPUT_CODE_ALREADY_USED_ERROR

400error code 400

string

401error code 401

string

404error code 404

string

500error code 500

string

Try it

Server

Custom base URLOverrides the selected server when set.

Authorization

API keyRemember on this deviceInclude my values in samples

Parameters

tenantIdpath*The tenant against which the request is made. If left empty, the default tenant will be used.ridheadercdi-versionheaderX.Y of the X.Y.Z CDI version.

Bodyapplication/json

Request body

Request

curl -X POST "/appid-{appId}/public/recipe/signinup/code" \
  -H "api-key: YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
  "email": "test@example.com"
}'

const response = await fetch("/appid-{appId}/public/recipe/signinup/code", {
  method: "POST",
  headers: {
    "api-key": "YOUR_API_KEY",
    "Content-Type": "application/json"
  },
  body: JSON.stringify({
  "email": "test@example.com"
})
});

import requests

response = requests.post(
    "/appid-{appId}/public/recipe/signinup/code",
    headers={
        "api-key": "YOUR_API_KEY",
        "Content-Type": "application/json"
    },
    json={
  "email": "test@example.com"
},
)

Response

{
  "status": "OK",
  "preAuthSessionId": "kFmkPQEAJtACiT2w/K8fndEuNm+XozJXSZSlWEr+iGs=",
  "codeId": "QZ0Mx9zG9cfqNXmPI0I/67r9bpKghUBDQZeMMbayi+I=",
  "deviceId": "TU/52WOcktSv99zqaAZuWJG9BSoS0aRLfCbep8rFEwk=",
  "userInputCode": 456123,
  "linkCode": "b10lbT_SnDC4flA6Fn7pE5TtG5k5NfigLef4QMBeGA8",
  "timeCreated": 1637262633029,
  "codeLifetime": 900000
}

"string"

"Invalid API key"

"Not Found"

"Internal Error"