API reference

The reference is generated at build time from the specification fragments each feature owns. Each section below is one fragment, rendered as written.

Fragments

1. AUTH4D-1 API surface
2. AUTH4D-2 shared API and protocol contracts
   • Customer authentication
   • Management and console
3. AUTH4D-3 D1 persistence boundary
4. AUTH4D-4 runtime boundary
   • Runtime endpoints
5. AUTH4D-5 signing and protected-secret behavior
6. AUTH4D-7: Structured logs and audit records
7. AUTH4D-8 tenant and application policy
   • Project membership policy
8. AUTH4D-9 identity and user lifecycle behavior
9. AUTH4D-10 — Transactional email delivery
   • Delivery flow
   • Provider and local adapters
   • Database migration
10. AUTH4D-11 sessions and refresh behavior
11. AUTH4D-12 OAuth authorization code and OIDC endpoints
    • Discovery and keys
    • Authorization and consent
    • Token, UserInfo and revocation
    • Runtime binding
12. AUTH4D-13 email-code authentication
    • Request and confirm
    • Abuse limits and account policy
    • Runtime composition handover
13. AUTH4D-14 Discord social authentication
    • Start and callback
    • Provider configuration
14. AUTH4D-15 guest authentication and account upgrades
    • Create a guest session
    • Create or renew a linking intent
    • Complete an upgrade
    • Session and deployment requirements
15. AUTH4D-16 native device authorization
    • Start a device authorization
    • Verify, approve, or deny
    • Poll and exchange
16. AUTH4D-17 console sign-in and management authentication
    • Sign-in protocol
    • API session routes
    • BFF session routes
    • Code layout
    • Management authorization
    • Runtime wiring
17. AUTH4D-18 project and application management
    • Roles and authorization
    • Projects
    • Applications
    • Idempotent creation
    • Effect on authentication
    • Errors
    • Operations
18. AUTH4D-19 user, session and audit management
    • Authorization
    • Pagination and filters
    • Lifecycle actions
    • Audit events
19. AUTH4D-20 developer-console shell
    • Browser-to-BFF contract
    • Routes and navigation (frozen)
    • Tests
20. AUTH4D-21 project onboarding and application configuration screens
    • Behavior
    • Tests
21. AUTH4D-22 console operations screens
    • BFF allow-list
    • Screens
    • Tests
22. AUTH4D-23 hosted login and device approval pages
    • Pages
    • Existing endpoints used
    • Required API additions (not implemented by this ticket)
    • Guest upgrade window protocol
    • Tests
23. AUTH4D-24 TypeScript browser SDK
24. AUTH4D-25 TypeScript server token verification SDK
25. AUTH4D-27 retention and deferred data deletion
    • Retention policy
    • User deletion
    • Inactive guests
    • Bounded processing
26. AUTH4D-28 public website and documentation
    • Published routes
    • Fragment rendering
27. AUTH4D-29 cross-stack verification and release evidence
    • Running
    • Coverage
    • Defects corrected in owning modules
    • Identified limits
28. Deployed environments and origins

Source: docs/api-spec. Run pnpm api-spec:generate for the same fragments combined into one Markdown file.