SuperdindaDocs
Auth

Sign in with a provider

POST
/auth/providers/{provider}/login

Google or Apple ID token, verified against the provider's keys. A verified email that already has an account links to it; an unknown one signs up.

Path Parameters

provider*string
Value in"google""apple"

Request Body

application/json
  1. body
idToken*string

the OIDC ID token the provider's SDK handed the app

Length16 <= length <= 4096
displayName?string

Apple never puts the name in the token: the app sends it on the first sign-in

Length1 <= length <= 120

Response Body

Access JWT in the envelope; refresh token in an httpOnly cookie

application/json
  1. response
success*true
Value intrue
data*
Example Request
curl -X POST 'http://localhost:3000/auth/providers/google/login' \  -H 'Content-Type: application/json' \  -d '{  "idToken": "stringstringstri"}'
Example Response
{  "success": true,  "data": {    "accessToken": "string",    "expiresAtMs": "string"  }}

Mail a new magic link from a dead one POST

The dead link's token says where the new link goes — the caller never names an address. Voids any live code or link and mails a fresh link to the same account. Always 202: `emailMasked` is null when the token is not a link we sent or is older than OTP_RESEND_MAX_AGE_HOURS (default 168), and a disabled account is answered the same and mailed nothing. Limits: RATE_OTP_RESEND_PER_LINK (default 3 per hour), the address's RATE_OTP_REQUEST_PER_EMAIL budget (shared with /auth/otp/request) and RATE_OTP_REQUEST_PER_IP.

Refresh POST

Trades the refresh cookie for a fresh access JWT. A dead cookie is cleared on refusal.