Handles all aspects of authentication and identity in Boost.space.

Session login

POST /auth authenticates with email/password and establishes a server-side session valid for 20 minutes (sliding — every request resets the timeout). DELETE /auth logs out and invalidates the session.

Two-factor authentication (2FA)

When 2FA is enabled on an account, a successful POST /auth returns error E4031 instead of a session. The client must then POST /auth/2fa with the TOTP code to complete login. 2FA setup and per-user device management is handled under /user/{userId}/2fa.

Bearer token authentication

Private tokens are generated via POST /auth/{userId}/token. Pass the token in every request as Authorization: Bearer <TOKEN> or X-Authorization: Bearer <TOKEN>. Each token carries per-module CRUD permission scopes. Bearer tokens do not use sessions and do not have sliding expiry.

Token priority

/auth/token-priority controls which authentication method takes precedence when multiple valid credentials are present in a single request.

OAuth 2.0

Boost.space acts as an OAuth 2.0 authorization server. /auth/oauth/client manages registered OAuth clients. /auth/oauth/token issues access tokens, /auth/oauth/renew refreshes them, and /auth/oauth/revoke revokes them. /auth/oauth/authorize is the authorization endpoint for the authorization code flow.

Social login

Login via Facebook (/auth/facebook), Google (/auth/google), LinkedIn (/auth/linkedin), and X (/auth/x) is supported through OAuth redirects.

Field history

/auth/field-history/{module}/{recordId} returns the audit log of field changes made by the currently authenticated user for a given record.