Client Signin
- Written for
- ＋ Written for
- Deprecated
- ＋ Deprecated
- Applies to
- ＋ Applies to
Client Signin
Frontend API — publishable key (x-publishable-key) plus the user session.
29 routes. Each row is one endpoint with its explanation and whether it honours the Idempotency-Key header.
Method & path | Idem | Explanation |
|---|---|---|
| Start an email + password sign-up. Returns an attempt whose status drives the next step. | |
| Reissue a verification code. Rate limited to 1/30s and 5/hour per address. | |
| Submit an email verification code. Three attempts, then the code is invalidated. | |
| Request a reset. Identical response for an address that does not exist. | |
| Submit the emailed code. Advances to MFA when the account has it. | |
| Second factor during a reset. Reset never bypasses MFA. | |
| Set the new password, revoke every session, and bump sessions_version. | |
| Start a sign-in. Returns the instance factor list, identical for unknown identifiers. | |
| Start a QR cross-device sign-in: returns the QR token/verification URL, a number-match code, and this tab’s poll secret. Opt-in; unauthenticated (publishable key). | |
| Phone lookup for a pending QR sign-in: the requesting browser’s device + coarse location and the match code to confirm. Requires the phone’s session. | |
| Phone approves a pending QR sign-in after confirming the number-match code; completes the attempt so the browser’s poll mints a session. Requires the phone’s session. | |
| Phone denies a pending QR sign-in, abandoning the attempt so the browser’s poll never completes. Requires the phone’s session. | |
| Send an email code or magic link. Returns the polling secret to this tab. | |
| Magic-link target. Completes the attempt; signs in no one here. | |
| Poll an attempt with its poll_secret; returns a ticket once complete. | |
| Submit a first factor. Advances to MFA or completes, as the server decides. | |
| Offer a passkey as the second factor. Credentials are named safely here. | |
| Start TOTP enrollment for an attempt parked by a required MFA policy. | |
| Confirm enrollment with two consecutive codes and complete the sign-in. | |
| Submit a TOTP or recovery code. The only route out of needs_second_factor. | |
| Begin passwordless sign-in. Names no user and lists no credentials. | |
| Verify an assertion and issue a session. The credential names the user. | |
| Begin an OAuth sign-in and receive the provider authorization URL. | |
| Native / One-Tap sign-in: verify a provider id_token (Google GSI, Apple, Facebook Limited Login) and complete the sign-in, honouring the MFA gate. | |
| LDAP/AD inbound sign-in: authenticate against a configured directory (connection_id + username + password) and JIT create/link the Atlas account, honouring the MFA gate. | |
| Kerberos / Integrated Windows Auth (IWA / SPNEGO) sign-in: a reverse proxy authenticates the principal and forwards it in a header; Atlas trusts it only behind a matching x-atlas-kerberos-secret, then resolves/JIT-links the account honouring the MFA gate. Opt-in, fail-closed. | |
| Migration interop: verify a foreign provider JWT (a configured externalJwt issuer) against its JWKS and complete the sign-in (JIT + MFA gate), to run Atlas alongside an old provider. | |
| Begin an enterprise SSO sign-in. Resolves an OIDC connection by id or email domain and returns the IdP authorization URL. | |
| Begin an enterprise SAML sign-in. Resolves a SAML connection by id or email domain and returns the IdP AuthnRequest URL. |