API Reference
The complete generated reference for tenant-facing Authreads APIs, including BFF account-security session, device, and policy operations. See Examples for copy-paste snippets.
POST /api/v1/auth/login/preflight returns RFC 7807 401 code: invalid_credentials, 429 code: rate_limited, or 429 code: login_temporarily_locked. Hosted POST /oauth/login/preflight returns OAuth 400 invalid_grant / error_code: invalid_credentials or 429 temporarily_unavailable with error_code: rate_limited or error_code: login_temporarily_locked. Rate-limited responses include delta-seconds Retry-After; unknown accounts remain indistinguishable from wrong passwords.OIDC session policy claim
Each newly issued OIDC ID token includes the signed collision-resistant claim https://authreads.com/claims/session_policy. Read its idle_timeout_minutes member after verifying the ID token, then apply that boundary to your relying-party session based on genuine browser activity. Token refresh is server activity and must not extend the human-idle window.
OIDC back-channel logout
In the admin dashboard, register one absolute HTTPS backchannel_logout_uri on the OIDC client. Authreads sends POST application/x-www-form-urlencoded with a single logout_tokenfield when that client's OIDC session is revoked or reaches absolute expiry. Return 200 or 204 after ending the local session; redirects and other statuses are failures.
Validate the JWT with the discovery document's JWKS: require alg=EdDSA, verify kid, signature, iss, your exact aud, iat, and exp; require the back-channel logout member inevents; reject any nonce; and deduplicate the stable jti. Use sid to end the exact RP session. The token is explicitly typed logout+jwt and also carries sub.