Authentication

Login, token refresh, password reset, sign-out (public except where noted).

📄️ Complete a password reset

**No token.** One of the calls you make before you have one. Send `X-Tenant-Code` where the operation lists it — that is which tenant you are asking about, not proof of who you are.

📄️ Refresh the access token

**Refresh token.** Not your access token — the refresh token, from the `HttpOnly` cookie in a browser or from the login response body on native.

📄️ Sign out

**Refresh token.** Not your access token — the refresh token, from the `HttpOnly` cookie in a browser or from the login response body on native.

📄️ Sign in

**No token.** One of the calls you make before you have one. Send `X-Tenant-Code` where the operation lists it — that is which tenant you are asking about, not proof of who you are.

📄️ Complete an invite by setting the first password

**No token.** One of the calls you make before you have one. Send `X-Tenant-Code` where the operation lists it — that is which tenant you are asking about, not proof of who you are.

📄️ Sign out everywhere

**User token.** Called by your app on behalf of the person holding the wallet. A machine token cannot call this.

📄️ Request a password reset

**No token.** One of the calls you make before you have one. Send `X-Tenant-Code` where the operation lists it — that is which tenant you are asking about, not proof of who you are.

📄️ Mint a user token for a subject you authenticated

**Machine token.** Called by your backend, using your `client_credentials` token.

📄️ Read the password policy

**No token.** One of the calls you make before you have one. Send `X-Tenant-Code` where the operation lists it — that is which tenant you are asking about, not proof of who you are.

📄️ Get a machine token

**Client credentials.** Your `client_id` and `client_secret`. This is the call that gives you the machine token every other operation asks for.