castomAPI
Get your key

The platform · auth.castomapi.com

Auth

One identity for every product: sign-in, sessions, OAuth clients, projects and the revocation keys every service checks.

71 operationsOpenAPI → dash-bcastomocastomUIcastomFlow

castomapi-auth is the account. A person signs up once — with a password, or through Google, GitHub or Apple — and that identity is what dash-b, castomo, the ops console and every castomAPI service recognise. Sessions are tokens the other services verify locally, with revocation pushed to them so a signed-out session dies everywhere at once.

It is also an OAuth provider: a product built on the platform registers a client, sends its users to castomAPI to consent, and receives a token scoped to its own project. Projects keep tenants apart; a user in one project is invisible to another.

Operations

MethodPathDescription
GET/accountThe account page
GET/auth/{clientId}/forgotHosted forgot password screen
GET/auth/{clientId}/resetHosted password reset screen
GET/auth/{clientId}/sign-inHosted sign in screen
GET/auth/{clientId}/sign-upHosted sign up screen
GET/auth/{clientId}/verifyHosted email verification screen
GET/dashboardTenant dashboard
GET/oauth/authorizeAuthorization endpoint
POST/oauth/authorizeComplete authorization after consent
GET/oauth/logoutEnd session endpoint
POST/oauth/tokenToken endpoint
GET/oauth/userinfoUserInfo endpoint
GET/v1/accountThe signed-in account and its security settings
POST/v1/account/mfa/confirmConfirm two-factor and receive recovery codes
POST/v1/account/mfa/disableTurn two-factor off
POST/v1/account/mfa/enrolBegin turning two-factor on
POST/v1/auth/change-passwordChange password
POST/v1/auth/forgot-passwordRequest a password reset link
POST/v1/auth/guest-tokenMint a guest token for one castomapi-live room
POST/v1/auth/loginExchange credentials for a session
POST/v1/auth/login/mfaFinish signing in with a second factor
POST/v1/auth/logoutEnd the current session
POST/v1/auth/logout-allEnd every session for this user
DELETE/v1/auth/meErase your account, irreversibly
GET/v1/auth/meRead the authenticated user
GET/v1/auth/me/exportDownload everything held about you
GET/v1/auth/me/identitiesList linked provider accounts
DELETE/v1/auth/me/identities/{provider}Unlink a provider account
GET/v1/auth/me/loginsRecent sign-ins on your account
GET/v1/auth/me/{namespace}Read your own profile or settings
PATCH/v1/auth/me/{namespace}Update your own profile or settings
GET/v1/auth/mfaWhether two-factor is enabled on this account
POST/v1/auth/mfa/confirmConfirm enrolment and receive recovery codes
POST/v1/auth/mfa/disableTurn two-factor off
POST/v1/auth/mfa/enrolBegin enrolment
POST/v1/auth/refreshRotate a refresh token
POST/v1/auth/registerCreate an account
POST/v1/auth/resend-verificationResend a verification email
POST/v1/auth/reset-passwordRedeem a reset link and set a new password
GET/v1/auth/social/{clientId}/{provider}/callbackProvider callback
GET/v1/auth/social/{clientId}/{provider}/startBegin sign-in with an external provider
POST/v1/auth/verify-emailConfirm an email address
POST/v1/mail/testSend a rendered template to the caller's own inbox
GET/v1/members/List members of the active tenant
POST/v1/members/change-passwordChange your password
GET/v1/members/invitationsList pending invitations
POST/v1/members/invitationsInvite someone to this tenant
POST/v1/members/invitations/acceptAccept an invitation
DELETE/v1/members/invitations/{invitationId}Revoke a pending invitation
POST/v1/members/loginSign in to the dashboard
POST/v1/members/login/mfaFinish signing in with a second factor
POST/v1/members/logoutEnd this session
POST/v1/members/logout-allEnd every session for this account
GET/v1/members/meWho am I, and what may I do
GET/v1/members/mfaWhether two-factor is enabled, and codes remaining
POST/v1/members/mfa/confirmConfirm enrolment and receive recovery codes
POST/v1/members/mfa/disableTurn two-factor off
POST/v1/members/mfa/enrolBegin enrolment
POST/v1/members/mfa/recovery-codesReplace the recovery codes
POST/v1/members/switch-tenantChange which tenant this session acts on
DELETE/v1/members/{memberId}Remove someone from this tenant
PATCH/v1/members/{memberId}/roleChange a member's role
GET/v1/projects/{clientId}/auth-configBranding and sign-up fields for the hosted screens
GET/v1/projects/{clientId}/schema/{namespace}Read a project's field definitions
GET/v1/publishers/meThe publisher space this account owns, if any
POST/v1/publishers/meCreate this account's publisher space, or return the existing one
POST/v1/publishers/me/sessionExchange this end-user session for admin standing over your own space
DELETE/v1/sso/sessionEnd the single sign-on session
GET/v1/sso/sessionReport the current single sign-on session
POST/v1/sso/sessionOpen the single sign-on session
POST/v1/tenantsSign up as a tenant

Base URL: https://auth.castomapi.com · Open the live docs

The platform

Billing & plans

Plan entitlements for every castomo product: Stripe subscriptions in, effective quotas out, pushed to the product that enforces them.

Pay

Payments between people and businesses on the platform, with Stripe underneath.

Book

Bookings and availability: resources, slots, reservations, reminders and refunds by policy.

Events

A free global events API: what is happening where, for dashboards and sites that need a calendar they did not write.

Data

Free global reference data: countries, languages, currencies, logistics, standards — tens of millions of records, no key.

Query

Read-only SQL and document queries against the customer's own MySQL, PostgreSQL or MongoDB, from a browser, safely.