Auth
Identity lookup, sign-in, token refresh, sign-out and password recovery.
Look up an account
Exchange an account's email address for its id, which the login endpoint takes as `identity`. The id does not change, so a partner system can store it and skip this call afterwards.
Sign in
Sign in with the account id from the verify step and the account's password. Returns an access token and a refresh token. A wrong password and an unknown account give the same answer. Repeated failures lock sign-in for the account for a while.
Sign out
End the session for the access token sent.
Refresh the session
Exchange a refresh token for a new access token and a new refresh token. Each refresh token can be exchanged once. If the answer is lost and the same token is presented again within about a minute, the same replacement is returned, so a single retry is safe.
Request a password reset
Send password reset instructions to the account's email address. The answer is the same whether or not the address belongs to an account.
Reset a password
Set a new password using the token, expiry and signature from the reset link.