Auth & account

GET    /api/auth/status                    # public: is setup complete, login methods
POST   /api/auth/setup                     # public: first-run admin account creation
POST   /api/auth/login                     # public: { username, password } -> tokens
POST   /api/auth/refresh                   # public: mint access token (refresh token is stable; legacy JWT refresh tokens migrate to the opaque scheme; 401 only on genuine revocation, 503 on transient faults)
POST   /api/auth/connect                   # public: redeem a connect-link token -> session
POST   /api/auth/passkey/login/begin|finish   # public: WebAuthn login
POST   /api/auth/passkey/setup/begin|finish   # public: passkey setup via short-lived link
GET    /api/auth/me                        # user: profile + permissions; child + content_limits for a kids account
                                           #   (the same two fields ride the login/refresh/connect user object)
POST   /api/auth/password                  # user: set password (admin-enabled users only)
POST   /api/auth/plex-email                # user: share the email for a Plex invite (sends the invites their grants owe, auto-approves where enabled, notifies admins)
POST   /api/auth/passkey/register/begin|finish  # user: add passkey (admin-enabled only)
POST   /api/auth/passkey/setup-link        # user: mint a browser passkey-setup URL
GET    /api/auth/passkeys                  # user: list own passkeys
DELETE /api/auth/passkeys/{credentialID}   # user: remove own passkey
POST   /api/auth/logout                    # user: revoke this device's own session (sign out)

View the maintained source for this page.