Authentication API
Sign-In and Login APIfor Websites and Apps
Passwords, passkeys, email codes, social providers and authenticator codes, with sessions that end the moment a person signs out.
Passkeys
People sign in with Face ID, Touch ID, Windows Hello or a security key, and no password. A passkey that verified the person counts as the second factor.
Social Sign-In
Google, Apple, GitHub, Microsoft, Discord, X, Meta and any OpenID Connect provider. Apps can share the platform's one registration at a provider or use their own client ID.
Email Codes
Mail a short code and a link that both prove the address. The first proof creates the user when none exists.
Multi-Factor Authentication
Authenticator apps by RFC 6238, ten recovery codes shown once, and an account setting that requires a second factor of every member.
{
"challenge": "substrio_mfa_...",
"code": "482916"
}Sessions
Tokens are opaque and held by the server. Sign out, change a password or turn on MFA, and older sessions end at their next request.
Password changed · 14:02
Bring Your Users
Import users with their bcrypt, PBKDF2 or Argon2id password hashes. Nobody resets a password to move.
{
"email": "[email protected]",
"password_hash": "$2b$12$...",
"name": "Maya Chen"
}