All endpoints exposed by the instance API. Paths are rooted at your KL_PUBLIC_BASE_URL (e.g. https://api.kolaylogin.com). Authenticated endpoints read the __session cookie; admin endpoints on the dashboard surface require a dashboard JWT (Bearer).
Copy this quickstart guide as a prompt for LLMs to implement KolayLogin in your application.
Authentication
Method
Path
Description
POST
/v1/auth/sign-up/email-password
Create user + session
POST
/v1/auth/sign-in/email-password
Verify credentials + session
POST
/v1/auth/sign-in/magic-link
Request a magic-link email
GET
/v1/auth/magic-link/verify
Exchange token for session
POST
/v1/auth/sign-in/sms-otp
Send a 6-digit SMS code
POST
/v1/auth/sms/verify
Verify code + create session
GET
/v1/auth/oauth/:provider/authorize
Start OAuth flow
GET
/v1/auth/oauth/:provider/callback
Exchange code + session
POST
/v1/auth/sign-out
End this client
POST
/v1/auth/sign-out/all
End every session for the user
Passkeys
Method
Path
Description
POST
/v1/auth/me/passkeys/register/begin
Get challenge (auth required)
POST
/v1/auth/me/passkeys/register/complete
Finish registration (auth required)
POST
/v1/auth/passkeys/authenticate/begin
Get challenge for sign-in
POST
/v1/auth/passkeys/authenticate/complete
Finish sign-in + session
Sessions
Method
Path
Description
POST
/v1/auth/sessions/refresh
Rotate __client + mint new __session
Organizations
Method
Path
Description
GET
/v1/orgs
List current user's orgs
POST
/v1/orgs
Create an org
POST
/v1/orgs/:id/invitations
Invite a user
GET
/v1/orgs/:id/invitations
List invites
POST
/v1/orgs/invitations/accept
Accept via one-time token
PATCH
/v1/orgs/current
Switch active org
Billing
Method
Path
Description
GET
/v1/billing/plans
Public plan catalog
POST
/v1/billing/checkout
Create a Stripe Checkout session
GET
/v1/billing/subscription
Current user's subscription (if any)
POST
/v1/stripe/webhook
Stripe → KolayLogin webhook receiver
Well-known
Method
Path
Description
GET
/.well-known/jwks.json
Public keys for session JWT verification
GET
/healthz
Process liveness probe
Conventions
Request bodies are JSON. Responses return { ok: true, ... } on success and standard HTTP status codes on failure with { error: string, message?: string }.