Passwordless Authentication

Token types

• auth tokens are for direcrly authenticating against other API routes.
• team tokens are intended to be shared with other team members, so that they can complete the Team-based login flow.
• verify tokens are sent to a user's email address, and are used to verify that a user controls the address. They expire after 10 minutes, and are used in the Registration and verification-based login flow.

Registration and verification-based login

POST /api/v1/auth/submit

This sends an email to the address contained in .email, with a token of kind verify. If .register is true, then the account must not currently exist. If .register is false, the account must currently exist.

{
  "email": "[email protected]",
  "name": "team name",
  "division": 0, // One of Object.values(config.divisions)
  "register": true
}

Response

{
  "kind": "goodVerifySent",
  "message": "The account verification email was sent.",
  "data": null
}

POST /api/v1/auth/verify

This endpoint converts the verify token contained within the email sent in the previous step into a team token and an auth token. Each verify token can only be used once.

{
  "verifyToken": "abcd"
}

Response

{
  "kind": "goodVerify",
  "message": "The email was verified.",
  "data": {
    "authToken": "abcd",
    "teamToken": "abcd"
  }
}

The team token can be shared with all members of the team. The auth token can be directly used for authentication with other API endpoints.

Team-based login

POST /api/v1/auth/login

This verifies the the passed in teamToken. If successful, it sends the authToken back to the client.

{
  "teamToken": "abcd"
}

Response

{
  "kind": "goodLogin",
  "message": "The login was successful.",
  "data": {
    "authToken": "abcd"
  }
}

This auth token is equivalent to an auth token obtained from the Registration and verification-based login flow.