> **Can't find what you're looking for?** Use `search_docs` on the docs MCP server at `https://www.openfort.io/api/mcp` to find what you need.
>
> **Have feedback?** Use `submit_feedback` on the same MCP server.

# Sign In and Sign Up

Create user sessions: email and password, email OTP, phone, social providers, or anonymously — plus sign out.

## Sign in with a social provider

`POST /iam/v2/auth/sign-in/social`

### Request body (required) (`application/json`)

- `callbackURL` `string | null`: Callback URL to redirect to after the user has signed in
- `newUserCallbackURL` `string | null`
- `errorCallbackURL` `string | null`: Callback URL to redirect to if an error happens
- `provider` `string` _(required)_
- `disableRedirect` `boolean | null`: Disable automatic redirection to the provider. Useful for handling the redirection yourself
- `idToken` `object | null`
  - `token` `string` _(required)_: ID token from the provider
  - `nonce` `string | null`: Nonce used to generate the token
  - `accessToken` `string | null`: Access token from the provider
  - `refreshToken` `string | null`: Refresh token from the provider
  - `expiresAt` `number | null`: Expiry date of the token
- `scopes` `array | null`: Array of scopes to request from the provider. This will override the default scopes passed.
- `requestSignUp` `boolean | null`: Explicitly request sign-up. Useful when disableImplicitSignUp is true for this provider
- `loginHint` `string | null`: The login hint to use for the authorization code request

### Responses

#### `200`: Success - Returns either session details or redirect URL

Body (`application/json`):

- `redirect` `boolean` _(required)_
- `token` `string` _(required)_: Session token
- `url` `string | null`
- `user` `object` _(required)_
  - `id` `string` _(required)_
  - `email` `string` _(required)_
  - `name` `string | null`
  - `image` `string | null`
  - `emailVerified` `boolean` _(required)_
  - `createdAt` `string <date-time>` _(required)_
  - `updatedAt` `string <date-time>` _(required)_
  - `isAnonymous` `boolean`

#### `400`: Bad Request. Usually due to missing parameters, or invalid parameters.

Body (`application/json`):

- `message` `string` _(required)_

#### `401`: Unauthorized. Due to missing or invalid authentication.

Body (`application/json`):

- `message` `string` _(required)_

#### `403`: Forbidden. You do not have permission to access this resource or to perform this action.

Body (`application/json`):

- `message` `string`

#### `404`: Not Found. The requested resource was not found.

Body (`application/json`):

- `message` `string`

#### `429`: Too Many Requests. You have exceeded the rate limit. Try again later.

Body (`application/json`):

- `message` `string`

#### `500`: Internal Server Error. This is a problem with the server that you cannot fix.

Body (`application/json`):

- `message` `string`

### Example request

```bash
curl https://api.openfort.io/iam/v2/auth/sign-in/social \
  --request POST \
  --header 'Content-Type: application/json' \
  --data '{
  "callbackURL": "string",
  "newUserCallbackURL": "string",
  "errorCallbackURL": "string",
  "provider": "string",
  "disableRedirect": true,
  "idToken": {
    "token": "string",
    "nonce": "string",
    "accessToken": "string",
    "refreshToken": "string",
    "expiresAt": 0
  },
  "scopes": [
    "string"
  ],
  "requestSignUp": true,
  "loginHint": "string"
}'
```

```ts
fetch('https://api.openfort.io/iam/v2/auth/sign-in/social', {
  method: 'POST',
  headers: {
    'Content-Type': 'application/json'
  },
  body: JSON.stringify({
    callbackURL: 'string',
    newUserCallbackURL: 'string',
    errorCallbackURL: 'string',
    provider: 'string',
    disableRedirect: true,
    idToken: {
      token: 'string',
      nonce: 'string',
      accessToken: 'string',
      refreshToken: 'string',
      expiresAt: 0
    },
    scopes: ['string'],
    requestSignUp: true,
    loginHint: 'string'
  })
})
```

## Sign out

`POST /iam/v2/auth/sign-out`

Sign out the current user

### Request body (`application/json`)

### Responses

#### `200`: Success

Body (`application/json`):

- `success` `boolean`

#### `400`: Bad Request. Usually due to missing parameters, or invalid parameters.

Body (`application/json`):

- `message` `string` _(required)_

#### `401`: Unauthorized. Due to missing or invalid authentication.

Body (`application/json`):

- `message` `string` _(required)_

#### `403`: Forbidden. You do not have permission to access this resource or to perform this action.

Body (`application/json`):

- `message` `string`

#### `404`: Not Found. The requested resource was not found.

Body (`application/json`):

- `message` `string`

#### `429`: Too Many Requests. You have exceeded the rate limit. Try again later.

Body (`application/json`):

- `message` `string`

#### `500`: Internal Server Error. This is a problem with the server that you cannot fix.

Body (`application/json`):

- `message` `string`

### Example request

```bash
curl https://api.openfort.io/iam/v2/auth/sign-out \
  --request POST \
  --header 'Content-Type: application/json' \
  --data '{}'
```

```ts
fetch('https://api.openfort.io/iam/v2/auth/sign-out', {
  method: 'POST',
  headers: {
    'Content-Type': 'application/json'
  },
  body: JSON.stringify({})
})
```

## Sign up with email and password

`POST /iam/v2/auth/sign-up/email`

Sign up a user using email and password

### Request body (`application/json`)

- `name` `string` _(required)_: The name of the user
- `email` `string` _(required)_: The email of the user
- `password` `string` _(required)_: The password of the user
- `image` `string`: The profile image URL of the user
- `callbackURL` `string`: The URL to use for email verification callback
- `rememberMe` `boolean`: If this is false, the session will not be remembered. Default is `true`.

### Responses

#### `200`: Successfully created user

Body (`application/json`):

- `token` `string | null`: Authentication token for the session
- `user` `object` _(required)_
  - `id` `string` _(required)_
  - `name` `string` _(required)_
  - `email` `string` _(required)_
  - `emailVerified` `boolean`
  - `image` `string`
  - `createdAt` `string` _(required)_
  - `updatedAt` `string` _(required)_
  - `isAnonymous` `boolean`
  - `phoneNumber` `string`
  - `phoneNumberVerified` `boolean`

#### `400`: Bad Request. Usually due to missing parameters, or invalid parameters.

Body (`application/json`):

- `message` `string` _(required)_

#### `401`: Unauthorized. Due to missing or invalid authentication.

Body (`application/json`):

- `message` `string` _(required)_

#### `403`: Forbidden. You do not have permission to access this resource or to perform this action.

Body (`application/json`):

- `message` `string`

#### `404`: Not Found. The requested resource was not found.

Body (`application/json`):

- `message` `string`

#### `422`: Unprocessable Entity. User already exists or failed to create user.

Body (`application/json`):

- `message` `string`

#### `429`: Too Many Requests. You have exceeded the rate limit. Try again later.

Body (`application/json`):

- `message` `string`

#### `500`: Internal Server Error. This is a problem with the server that you cannot fix.

Body (`application/json`):

- `message` `string`

### Example request

```bash
curl https://api.openfort.io/iam/v2/auth/sign-up/email \
  --request POST \
  --header 'Content-Type: application/json' \
  --data '{
  "name": "string",
  "email": "string",
  "password": "string",
  "image": "string",
  "callbackURL": "string",
  "rememberMe": true
}'
```

```ts
fetch('https://api.openfort.io/iam/v2/auth/sign-up/email', {
  method: 'POST',
  headers: {
    'Content-Type': 'application/json'
  },
  body: JSON.stringify({
    name: 'string',
    email: 'string',
    password: 'string',
    image: 'string',
    callbackURL: 'string',
    rememberMe: true
  })
})
```

## Sign in with email and password

`POST /iam/v2/auth/sign-in/email`

### Request body (required) (`application/json`)

- `email` `string` _(required)_: Email of the user
- `password` `string` _(required)_: Password of the user
- `callbackURL` `string | null`: Callback URL to use as a redirect for email verification
- `rememberMe` `boolean | null`

### Responses

#### `200`: Success - Returns either session details or redirect URL

Body (`application/json`):

- `redirect` `boolean` _(required)_
- `token` `string` _(required)_: Session token
- `url` `string | null`
- `user` `object` _(required)_
  - `id` `string` _(required)_
  - `email` `string` _(required)_
  - `name` `string | null`
  - `image` `string | null`
  - `emailVerified` `boolean` _(required)_
  - `createdAt` `string <date-time>` _(required)_
  - `updatedAt` `string <date-time>` _(required)_
  - `isAnonymous` `boolean`

#### `400`: Bad Request. Usually due to missing parameters, or invalid parameters.

Body (`application/json`):

- `message` `string` _(required)_

#### `401`: Unauthorized. Due to missing or invalid authentication.

Body (`application/json`):

- `message` `string` _(required)_

#### `403`: Forbidden. You do not have permission to access this resource or to perform this action.

Body (`application/json`):

- `message` `string`

#### `404`: Not Found. The requested resource was not found.

Body (`application/json`):

- `message` `string`

#### `429`: Too Many Requests. You have exceeded the rate limit. Try again later.

Body (`application/json`):

- `message` `string`

#### `500`: Internal Server Error. This is a problem with the server that you cannot fix.

Body (`application/json`):

- `message` `string`

### Example request

```bash
curl https://api.openfort.io/iam/v2/auth/sign-in/email \
  --request POST \
  --header 'Content-Type: application/json' \
  --data '{
  "email": "string",
  "password": "string",
  "callbackURL": "string",
  "rememberMe": true
}'
```

```ts
fetch('https://api.openfort.io/iam/v2/auth/sign-in/email', {
  method: 'POST',
  headers: {
    'Content-Type': 'application/json'
  },
  body: JSON.stringify({
    email: 'string',
    password: 'string',
    callbackURL: 'string',
    rememberMe: true
  })
})
```

## Anonymous sign in

`POST /iam/v2/auth/sign-in/anonymous`

Sign in anonymously

### Responses

#### `200`: Sign in anonymously

Body (`application/json`):

- `token` `string` _(required)_: Session token
- `user` `object` _(required)_
  - `id` `string` _(required)_
  - `name` `string` _(required)_
  - `email` `string` _(required)_
  - `emailVerified` `boolean`
  - `image` `string`
  - `createdAt` `string` _(required)_
  - `updatedAt` `string` _(required)_
  - `isAnonymous` `boolean`
  - `phoneNumber` `string`
  - `phoneNumberVerified` `boolean`

#### `400`: Bad Request. Usually due to missing parameters, or invalid parameters.

Body (`application/json`):

- `message` `string` _(required)_

#### `401`: Unauthorized. Due to missing or invalid authentication.

Body (`application/json`):

- `message` `string` _(required)_

#### `403`: Forbidden. You do not have permission to access this resource or to perform this action.

Body (`application/json`):

- `message` `string`

#### `404`: Not Found. The requested resource was not found.

Body (`application/json`):

- `message` `string`

#### `429`: Too Many Requests. You have exceeded the rate limit. Try again later.

Body (`application/json`):

- `message` `string`

#### `500`: Internal Server Error. This is a problem with the server that you cannot fix.

Body (`application/json`):

- `message` `string`

### Example request

```bash
curl https://api.openfort.io/iam/v2/auth/sign-in/anonymous \
  --request POST
```

```ts
fetch('https://api.openfort.io/iam/v2/auth/sign-in/anonymous', {
  method: 'POST'
})
```

## Sign in with phone

`POST /iam/v2/auth/sign-in/phone-number`

Use this endpoint to sign in with phone number

### Request body (required) (`application/json`)

- `phoneNumber` `string` _(required)_: Phone number to sign in. Eg: "+1234567890"
- `password` `string` _(required)_: Password to use for sign in.
- `rememberMe` `boolean | null`: Remember the session. Eg: true

### Responses

#### `200`: Success

Body (`application/json`):

- `token` `string` _(required)_: Session token
- `user` `object` _(required)_
  - `id` `string` _(required)_
  - `name` `string` _(required)_
  - `email` `string` _(required)_
  - `emailVerified` `boolean`
  - `image` `string`
  - `createdAt` `string` _(required)_
  - `updatedAt` `string` _(required)_
  - `isAnonymous` `boolean`
  - `phoneNumber` `string`
  - `phoneNumberVerified` `boolean`

#### `400`: Invalid phone number or password

#### `401`: Unauthorized. Due to missing or invalid authentication.

Body (`application/json`):

- `message` `string` _(required)_

#### `403`: Forbidden. You do not have permission to access this resource or to perform this action.

Body (`application/json`):

- `message` `string`

#### `404`: Not Found. The requested resource was not found.

Body (`application/json`):

- `message` `string`

#### `429`: Too Many Requests. You have exceeded the rate limit. Try again later.

Body (`application/json`):

- `message` `string`

#### `500`: Internal Server Error. This is a problem with the server that you cannot fix.

Body (`application/json`):

- `message` `string`

### Example request

```bash
curl https://api.openfort.io/iam/v2/auth/sign-in/phone-number \
  --request POST \
  --header 'Content-Type: application/json' \
  --data '{
  "phoneNumber": "string",
  "password": "string",
  "rememberMe": true
}'
```

```ts
fetch('https://api.openfort.io/iam/v2/auth/sign-in/phone-number', {
  method: 'POST',
  headers: {
    'Content-Type': 'application/json'
  },
  body: JSON.stringify({
    phoneNumber: 'string',
    password: 'string',
    rememberMe: true
  })
})
```

## Sign in with email OTP

`POST /iam/v2/auth/sign-in/email-otp`

Sign in with OTP

### Request body (required) (`application/json`)

- `email` `string` _(required)_: Email address to sign in
- `otp` `string` _(required)_: OTP sent to the email

### Responses

#### `200`: Success

Body (`application/json`):

- `token` `string` _(required)_: Session token for the authenticated session
- `user` `object` _(required)_
  - `id` `string` _(required)_
  - `name` `string` _(required)_
  - `email` `string` _(required)_
  - `emailVerified` `boolean`
  - `image` `string`
  - `createdAt` `string` _(required)_
  - `updatedAt` `string` _(required)_
  - `isAnonymous` `boolean`
  - `phoneNumber` `string`
  - `phoneNumberVerified` `boolean`

#### `400`: Bad Request. Usually due to missing parameters, or invalid parameters.

Body (`application/json`):

- `message` `string` _(required)_

#### `401`: Unauthorized. Due to missing or invalid authentication.

Body (`application/json`):

- `message` `string` _(required)_

#### `403`: Forbidden. You do not have permission to access this resource or to perform this action.

Body (`application/json`):

- `message` `string`

#### `404`: Not Found. The requested resource was not found.

Body (`application/json`):

- `message` `string`

#### `429`: Too Many Requests. You have exceeded the rate limit. Try again later.

Body (`application/json`):

- `message` `string`

#### `500`: Internal Server Error. This is a problem with the server that you cannot fix.

Body (`application/json`):

- `message` `string`

### Example request

```bash
curl https://api.openfort.io/iam/v2/auth/sign-in/email-otp \
  --request POST \
  --header 'Content-Type: application/json' \
  --data '{
  "email": "string",
  "otp": "string"
}'
```

```ts
fetch('https://api.openfort.io/iam/v2/auth/sign-in/email-otp', {
  method: 'POST',
  headers: {
    'Content-Type': 'application/json'
  },
  body: JSON.stringify({
    email: 'string',
    otp: 'string'
  })
})
```