Email & password

The default sign-in method. Argon2id-hashed passwords, constant-time verification, rate limiting, and a configurable password policy per instance.

Endpoints

• POST /v1/auth/sign-up/email-password  — create user + session
• POST /v1/auth/sign-in/email-password  — verify + session
• POST /v1/auth/sign-out  — end this client
• POST /v1/auth/sign-out/all  — end every session for the user

Request shape

{
  "email": "ada@example.com",
  "password": "correct-horse-battery-staple"
}

Both sign-up and sign-in respond with the created session shape and set __client + __session cookies:

{ "userId": "...", "sessionId": "..." }

Client example

async function signIn(email: string, password: string) {
  const res = await fetch(base + '/v1/auth/sign-in/email-password', {
    method: 'POST',
    credentials: 'include',
    headers: { 'content-type': 'application/json' },
    body: JSON.stringify({ email, password }),
  });
  if (!res.ok) throw new Error('invalid_credentials');
  return res.json();
}

Password policy

Per-instance policy configured from the dashboard. Hobby plans get the default; Pro+ can require uppercase / lowercase / digit / special.

{
  "minLength": 10,
  "requireUppercase": true,
  "requireLowercase": true,
  "requireNumber": true,
  "requireSpecial": false
}

Errors

• 400 password_too_short — fails the configured policy.
• 400 email_already_exists — on sign-up when the email is taken.
• 401 invalid_credentials — on sign-in with wrong email/password (constant-time).
• 429 signup_rate_limited / signin_rate_limited — sliding-window limit.