Hosted authentication pages
Navigate the browser to these routes to use SyAuth-hosted forms. Preserve cookies, hidden fields and the form CSRF token. Responses are HTML or redirects; HTTP 200 can also contain a form validation error. Use the OAuth integration guide to start an authorization flow.
API conventions · All endpoints · Schemas
/e/v1/auth/login/
Hosted application login.
GET
Browser navigation: pass client context (client_id or oauth_client, as listed below), optional redirect_uri and pkce_session_id. The response is an HTML form. Preserve its hidden inputs and session cookie.
Request fields (combine with the requirements and schema above):
| Location | Field | Fallback when absent |
|---|---|---|
| query | next | '/' |
| query | client_id | not supplied |
| query | oauth_params_token | not supplied |
| query | response_type | not supplied |
| query | scope | not supplied |
| query | nonce | not supplied |
| query | code_challenge | not supplied |
| query | code_challenge_method | not supplied |
| query | pkce_session_id | not supplied |
| query | oauth_flow | not supplied |
| query | state | not supplied |
| query | error | not supplied |
| query | redirect_uri | '' |
Success and error response examples
Illustrative values; conditional branches are alternatives. Fields vary with the operation and account configuration.
200 — html
HTML or text/XML response; do not parse as JSON.
POST
Submit the rendered form as application/x-www-form-urlencoded, including its CSRF token where rendered, session cookie and hidden OAuth parameters. Main form fields: email, password. Errors are rendered into HTML and may still have HTTP 200. Prefer the JSON endpoint for programmatic integration.
Request fields (combine with the requirements and schema above):
| Location | Field | Fallback when absent |
|---|---|---|
| form | email | not supplied |
| form | password | not supplied |
| form | next | '/' |
| query | client_id | not supplied |
| form | client_id | not supplied |
| query | redirect_uri | not supplied |
| form | redirect_uri | not supplied |
| query | oauth_params_token | not supplied |
| form | oauth_params_token | not supplied |
| query | state | not supplied |
| form | state | not supplied |
| query | response_type | not supplied |
| form | response_type | 'code' |
| query | scope | not supplied |
| form | scope | not supplied |
| query | nonce | not supplied |
| form | nonce | not supplied |
| query | code_challenge | not supplied |
| form | code_challenge | not supplied |
| query | code_challenge_method | not supplied |
| form | code_challenge_method | not supplied |
| query | oauth_flow | not supplied |
| form | oauth_flow | not supplied |
| query | pkce_session_id | not supplied |
| form | pkce_session_id | not supplied |
Success and error response examples
Illustrative values; conditional branches are alternatives. Fields vary with the operation and account configuration.
200 — html
HTML or text/XML response; do not parse as JSON.
302 — redirect
Redirect: inspect Location and preserve cookies.
/e/v1/auth/register/
Hosted application registration.
GET
Browser navigation: pass client context (client_id or oauth_client, as listed below), optional redirect_uri and pkce_session_id. The response is an HTML form. Preserve its hidden inputs and session cookie.
Request fields (combine with the requirements and schema above):
| Location | Field | Fallback when absent |
|---|---|---|
| query | redirect_uri | '' |
| query | code_challenge | not supplied |
| query | code_challenge_method | not supplied |
| query | state | not supplied |
| query | pkce_session_id | not supplied |
| query | client_id | not supplied |
| query | oauth_client | not supplied |
Success and error response examples
Illustrative values; conditional branches are alternatives. Fields vary with the operation and account configuration.
200 — html
HTML or text/XML response; do not parse as JSON.
POST
Submit the rendered form as application/x-www-form-urlencoded, including its CSRF token where rendered, session cookie and hidden OAuth parameters. Main form fields: email, password, confirm_password, first_name, last_name, oauth_client. Errors are rendered into HTML and may still have HTTP 200. Prefer the JSON endpoint for programmatic integration.
Request fields (combine with the requirements and schema above):
| Location | Field | Fallback when absent |
|---|---|---|
| form | email | not supplied |
| form | password | not supplied |
| form | confirm_password | not supplied |
| form | first_name | not supplied |
| form | last_name | not supplied |
| form | oauth_client | not supplied |
| form | redirect_uri | '' |
| form | code_challenge | not supplied |
| query | code_challenge | not supplied |
| form | code_challenge_method | not supplied |
| query | code_challenge_method | not supplied |
| form | state | not supplied |
| query | state | not supplied |
| form | pkce_session_id | not supplied |
| query | pkce_session_id | not supplied |
Related schemas: User.
Success and error response examples
Illustrative values; conditional branches are alternatives. Fields vary with the operation and account configuration.
200 — html
HTML or text/XML response; do not parse as JSON.
302 — redirect
Redirect: inspect Location and preserve cookies.
/e/v1/auth/verify-email/
Hosted email verification.
GET
Browser navigation: pass client context (client_id or oauth_client, as listed below), optional redirect_uri and pkce_session_id. The response is an HTML form. Preserve its hidden inputs and session cookie.
Request fields (combine with the requirements and schema above):
| Location | Field | Fallback when absent |
|---|---|---|
| query | email | not supplied |
| query | redirect_uri | '' |
| query | pkce_session_id | not supplied |
| query | client_id | not supplied |
| query | oauth_client | not supplied |
| query | registered | not supplied |
Success and error response examples
Illustrative values; conditional branches are alternatives. Fields vary with the operation and account configuration.
200 — html
HTML or text/XML response; do not parse as JSON.
POST
Submit the rendered form as application/x-www-form-urlencoded, including its CSRF token where rendered, session cookie and hidden OAuth parameters. Main form fields: email, code, oauth_client; resend=true selects resending. Errors are rendered into HTML and may still have HTTP 200. Prefer the JSON endpoint for programmatic integration.
Request fields (combine with the requirements and schema above):
| Location | Field | Fallback when absent |
|---|---|---|
| form | email | not supplied |
| form | code | not supplied |
| form | oauth_client | not supplied |
| query | redirect_uri | not supplied |
| form | redirect_uri | '' |
| form | resend | not supplied |
| form | pkce_session_id | not supplied |
| query | pkce_session_id | not supplied |
Success and error response examples
Illustrative values; conditional branches are alternatives. Fields vary with the operation and account configuration.
200 — html
HTML or text/XML response; do not parse as JSON.
/e/v1/auth/forgot-password/
Hosted reset request.
GET
Browser navigation: pass client context (client_id or oauth_client, as listed below), optional redirect_uri and pkce_session_id. The response is an HTML form. Preserve its hidden inputs and session cookie.
Request fields (combine with the requirements and schema above):
| Location | Field | Fallback when absent |
|---|---|---|
| query | redirect_uri | '' |
| query | pkce_session_id | not supplied |
| query | client_id | not supplied |
| query | oauth_client | not supplied |
Success and error response examples
Illustrative values; conditional branches are alternatives. Fields vary with the operation and account configuration.
200 — html
HTML or text/XML response; do not parse as JSON.
POST
Submit the rendered form as application/x-www-form-urlencoded, including its CSRF token where rendered, session cookie and hidden OAuth parameters. Main form fields: email, oauth_client. Errors are rendered into HTML and may still have HTTP 200. Prefer the JSON endpoint for programmatic integration.
Request fields (combine with the requirements and schema above):
| Location | Field | Fallback when absent |
|---|---|---|
| form | email | not supplied |
| form | oauth_client | not supplied |
| form | redirect_uri | '' |
| form | pkce_session_id | not supplied |
| query | pkce_session_id | not supplied |
Success and error response examples
Illustrative values; conditional branches are alternatives. Fields vary with the operation and account configuration.
200 — html
HTML or text/XML response; do not parse as JSON.
/e/v1/auth/reset-password/
Hosted reset confirmation.
GET
Browser navigation: pass client context (client_id or oauth_client, as listed below), optional redirect_uri and pkce_session_id. The response is an HTML form. Preserve its hidden inputs and session cookie.
Request fields (combine with the requirements and schema above):
| Location | Field | Fallback when absent |
|---|---|---|
| query | redirect_uri | '' |
| query | email | '' |
| query | code | '' |
| query | pkce_session_id | not supplied |
| query | client_id | not supplied |
| query | oauth_client | not supplied |
Success and error response examples
Illustrative values; conditional branches are alternatives. Fields vary with the operation and account configuration.
200 — html
HTML or text/XML response; do not parse as JSON.
POST
Submit the rendered form as application/x-www-form-urlencoded, including its CSRF token where rendered, session cookie and hidden OAuth parameters. Main form fields: email, code, new_password, confirm_password, oauth_client. Errors are rendered into HTML and may still have HTTP 200. Prefer the JSON endpoint for programmatic integration.
Request fields (combine with the requirements and schema above):
| Location | Field | Fallback when absent |
|---|---|---|
| form | email | not supplied |
| form | code | not supplied |
| form | new_password | not supplied |
| form | confirm_password | not supplied |
| form | oauth_client | not supplied |
| form | redirect_uri | '' |
| form | pkce_session_id | not supplied |
| query | pkce_session_id | not supplied |
Success and error response examples
Illustrative values; conditional branches are alternatives. Fields vary with the operation and account configuration.
200 — html
HTML or text/XML response; do not parse as JSON.