Auth
Request Body
application/json
TypeScript Definitions
Use the request body type in TypeScript.
Login + signup request body. password is the SHA-256 hex digest
of the user's plaintext password — see tl-server::auth_user for
the storage-side argon2 wrap.
Response Body
application/json
application/json
application/json
application/json
application/json
curl -X POST "https://example.com/v1/auth/login" \ -H "Content-Type: application/json" \ -d '{ "password": "string", "username": "string" }'{ "jwt": "string", "user_id": "string", "username": "string"}The caller must demonstrate knowledge of the current password by
including it in the request. tl-server does not issue per-user
session tokens (see docs/concept/authorization.md); the
current-password check is what proves account ownership here.
Request Body
application/json
TypeScript Definitions
Use the request body type in TypeScript.
Change-password request body. The caller demonstrates knowledge of the current password by hashing it the same way as a login.
Response Body
application/json
application/json
application/json
application/json
application/json
curl -X POST "https://example.com/v1/auth/password" \ -H "Content-Type: application/json" \ -d '{ "current_password": "string", "new_password": "string", "username": "string" }'{ "jwt": "string", "user_id": "string", "username": "string"}Request Body
application/json
TypeScript Definitions
Use the request body type in TypeScript.
Login + signup request body. password is the SHA-256 hex digest
of the user's plaintext password — see tl-server::auth_user for
the storage-side argon2 wrap.
Response Body
application/json
application/json
application/json
application/json
application/json
curl -X POST "https://example.com/v1/auth/signup" \ -H "Content-Type: application/json" \ -d '{ "password": "string", "username": "string" }'{ "jwt": "string", "user_id": "string", "username": "string"}This endpoint is internal-only and accepts only the internal
TL_API_KEY bearer lane. User-session JWTs and workspace runtime keys
(tl_live_...) are rejected with 401.
Request Body
application/json
TypeScript Definitions
Use the request body type in TypeScript.
OAuth identity resolved after Google/GitHub has already authenticated the browser user. This endpoint does not verify provider credentials; the trusted web app sends the provider's stable subject and profile after Auth.js completes the OAuth flow.
Response Body
application/json
application/json
application/json
application/json
curl -X POST "https://example.com/v1/identity/oauth-session" \ -H "Content-Type: application/json" \ -d '{ "email": "string", "provider": "string", "provider_subject": "string" }'{ "jwt": "string", "user_id": "string", "username": "string"}