Documentation

Authentication

Account sign-in, sign-up, recovery, verification, magic links, session lookup, and passkey registration.

Playground

Send these requests to your own running sidecar. Values stay in this browser.

Not connected

Base URL Bearer token optional Session token optional

How this works

The sidecar listens on a loopback port chosen at startup and prints it in its ready line; use that URL and the CADCAMFUN_TOKEN it was started with. Requests go straight from this page to that address.

The sidecar sends CORS headers only to the Tauri origins and to http://localhost or http://127.0.0.1 on any port. From the hosted docs the browser blocks the response, so run the docs locally (bun run dev in packages/web) to use the playground, or copy the request as curl. To experiment without touching real data, start the sidecar with CADCAMFUN_DATA_DIR pointed at a throwaway directory — see the API walkthrough.

Operations

15 endpoints in the auth group, generated from the sidecar's own OpenAPI document. Protected operations take Authorization: Bearer $CADCAMFUN_TOKEN; see authentication. Behaviour and limits are in the subsystem guide.

post	/api/auth/identity/start	auth.identityStart
post	/api/auth/identity/poll	auth.identityPoll
post	/api/auth/identity/cancel	auth.identityCancel
post	/api/auth/forgot-password	auth.forgotPassword
post	/api/auth/reset-password	auth.resetPassword
post	/api/auth/send-magic-link	auth.sendMagicLink
post	/api/auth/send-verification-email	auth.sendVerificationEmail
post	/api/auth/verify-email	auth.verifyEmail
post	/api/auth/signout	auth.signout
get	/api/auth/get-session	auth.getSession
post	/api/auth/signin-direct	auth.signinDirect
post	/api/auth/signup	auth.signup
post	/api/auth/test-direct-create	auth.testDirectCreate
post	/api/auth/verify-magic-link	auth.verifyMagicLink
post	/api/auth/passkey-register	auth.registerPasskey

Authentication operations in 3D Drag to orbit · scroll to zoom · right-drag to pan

One block per operation (15), stacked per resource section of this page and coloured by method: green GET, orange POST, blue PUT, violet PATCH, red DELETE. Generated from the OpenAPI document at build time.

/api/auth/identity

post /api/auth/identity/start # auth.identityStart

Requires Authorization: Bearer <token>.

Responses

200 object application/json

{
  id: string
  url: string
  issuer: string
}

401 UnauthorizedEncoded application/json

UnauthorizedEncoded

500 AuthInternalEncoded application/json

AuthInternalEncoded

fetch example

auth.identityStart

// Not generated in the Promise SDK (multipart, binary or raw body): call it with fetch.
const response = await fetch(`${process.env.CADCAMFUN_URL}/api/auth/identity/start`, {
  method: "POST",
  headers: { authorization: `Bearer ${process.env.CADCAMFUN_TOKEN}` },
})

curl

POST /api/auth/identity/start

curl --request POST "${CADCAMFUN_URL}/api/auth/identity/start" \
  --header "Authorization: Bearer ${CADCAMFUN_TOKEN}"

Try it

post /api/auth/identity/poll # auth.identityPoll

Requires Authorization: Bearer <token>.

Request body · required · application/json

{
  id: string
}

Responses

200 object | object | object application/json

{
  status: "pending"
} | {
  status: "complete"
  tokens: {
    access: string
    refresh: string
    expiresAt: number | "Infinity" | "-Infinity" | "NaN"
  }
} | {
  status: "failed"
  message: string
}

400 AuthBadRequestEncoded application/json

AuthBadRequestEncoded

401 UnauthorizedEncoded application/json

UnauthorizedEncoded

fetch example

auth.identityPoll

// Not generated in the Promise SDK (multipart, binary or raw body): call it with fetch.
const response = await fetch(`${process.env.CADCAMFUN_URL}/api/auth/identity/poll`, {
  method: "POST",
  headers: { authorization: `Bearer ${process.env.CADCAMFUN_TOKEN}` },
})

curl

POST /api/auth/identity/poll

curl --request POST "${CADCAMFUN_URL}/api/auth/identity/poll" \
  --header "Authorization: Bearer ${CADCAMFUN_TOKEN}" \
  --header "Content-Type: application/json" \
  --data-binary @request.json

Try it

Request body application/json

post /api/auth/identity/cancel # auth.identityCancel

Requires Authorization: Bearer <token>.

Request body · required · application/json

{
  id: string
}

Responses

200 object application/json

{
  success: true
  message: string
}

401 UnauthorizedEncoded application/json

UnauthorizedEncoded

fetch example

auth.identityCancel

// Not generated in the Promise SDK (multipart, binary or raw body): call it with fetch.
const response = await fetch(`${process.env.CADCAMFUN_URL}/api/auth/identity/cancel`, {
  method: "POST",
  headers: { authorization: `Bearer ${process.env.CADCAMFUN_TOKEN}` },
})

curl

POST /api/auth/identity/cancel

curl --request POST "${CADCAMFUN_URL}/api/auth/identity/cancel" \
  --header "Authorization: Bearer ${CADCAMFUN_TOKEN}" \
  --header "Content-Type: application/json" \
  --data-binary @request.json

Try it

Request body application/json

/api/auth/forgot-password

post /api/auth/forgot-password # auth.forgotPassword

Requires Authorization: Bearer <token>.

Request body · required · application/json

{
  email?: string | null
  callbackURL?: string | null
}

Responses

200 object application/json

{
  success: true
  message: string
  debugResetLink?: string | null
}

400 AuthBadRequestEncoded application/json

AuthBadRequestEncoded

401 UnauthorizedEncoded application/json

UnauthorizedEncoded

500 AuthInternalEncoded application/json

AuthInternalEncoded

SDK example

auth.forgotPassword

import { CadCam } from "@cadcamfun/api/sdk"

const client = CadCam.make({
  baseUrl: process.env.CADCAMFUN_URL!,
  headers: { authorization: `Bearer ${process.env.CADCAMFUN_TOKEN}` },
})

// AuthForgotPasswordInput
const result = await client.auth.forgotPassword({
  email: "",
  callbackURL: ""
})

curl

POST /api/auth/forgot-password

curl --request POST "${CADCAMFUN_URL}/api/auth/forgot-password" \
  --header "Authorization: Bearer ${CADCAMFUN_TOKEN}" \
  --header "Content-Type: application/json" \
  --data-binary @request.json

Try it

Request body application/json

/api/auth/reset-password

post /api/auth/reset-password # auth.resetPassword

Requires Authorization: Bearer <token>.

Request body · required · application/json

{
  token?: string | null
  newPassword?: string | null
  confirmPassword?: string | null
}

Responses

200 object application/json

{
  success: true
  message: string
  user: {
    id: string
    email: string
    name: string | null
  }
}

400 AuthBadRequestEncoded application/json

AuthBadRequestEncoded

401 UnauthorizedEncoded application/json

UnauthorizedEncoded

404 AuthNotFoundEncoded application/json

AuthNotFoundEncoded

500 AuthInternalEncoded application/json

AuthInternalEncoded

SDK example

auth.resetPassword

import { CadCam } from "@cadcamfun/api/sdk"

const client = CadCam.make({
  baseUrl: process.env.CADCAMFUN_URL!,
  headers: { authorization: `Bearer ${process.env.CADCAMFUN_TOKEN}` },
})

// AuthResetPasswordInput
const result = await client.auth.resetPassword({
  token: "",
  newPassword: "",
  confirmPassword: ""
})

curl

POST /api/auth/reset-password

curl --request POST "${CADCAMFUN_URL}/api/auth/reset-password" \
  --header "Authorization: Bearer ${CADCAMFUN_TOKEN}" \
  --header "Content-Type: application/json" \
  --data-binary @request.json

Try it

Request body application/json

/api/auth/send-magic-link

post /api/auth/send-magic-link # auth.sendMagicLink

Requires Authorization: Bearer <token>.

Request body · required · application/json

{
  email?: string | null
  callbackURL?: string | null
}

Responses

200 object application/json

{
  success: true
  message: string
  debugMagicLink?: string | null
}

400 AuthBadRequestEncoded application/json

AuthBadRequestEncoded

401 UnauthorizedEncoded application/json

UnauthorizedEncoded

500 AuthInternalEncoded application/json

AuthInternalEncoded

SDK example

auth.sendMagicLink

import { CadCam } from "@cadcamfun/api/sdk"

const client = CadCam.make({
  baseUrl: process.env.CADCAMFUN_URL!,
  headers: { authorization: `Bearer ${process.env.CADCAMFUN_TOKEN}` },
})

// AuthSendMagicLinkInput
const result = await client.auth.sendMagicLink({
  email: "",
  callbackURL: ""
})

curl

POST /api/auth/send-magic-link

curl --request POST "${CADCAMFUN_URL}/api/auth/send-magic-link" \
  --header "Authorization: Bearer ${CADCAMFUN_TOKEN}" \
  --header "Content-Type: application/json" \
  --data-binary @request.json

Try it

Request body application/json

/api/auth/send-verification-email

post /api/auth/send-verification-email # auth.sendVerificationEmail

Requires Authorization: Bearer <token>.

Request body · required · application/json

{
  email?: string | null
  callbackURL?: string | null
}

Responses

200 object application/json

{
  success: true
  message: string
  debug: {
    link: string
  }
}

400 AuthBadRequestEncoded application/json

AuthBadRequestEncoded

401 UnauthorizedEncoded application/json

UnauthorizedEncoded

404 AuthNotFoundEncoded application/json

AuthNotFoundEncoded

500 AuthInternalEncoded application/json

AuthInternalEncoded

SDK example

auth.sendVerificationEmail

import { CadCam } from "@cadcamfun/api/sdk"

const client = CadCam.make({
  baseUrl: process.env.CADCAMFUN_URL!,
  headers: { authorization: `Bearer ${process.env.CADCAMFUN_TOKEN}` },
})

// AuthSendVerificationEmailInput
const result = await client.auth.sendVerificationEmail({
  email: "",
  callbackURL: ""
})

curl

POST /api/auth/send-verification-email

curl --request POST "${CADCAMFUN_URL}/api/auth/send-verification-email" \
  --header "Authorization: Bearer ${CADCAMFUN_TOKEN}" \
  --header "Content-Type: application/json" \
  --data-binary @request.json

Try it

Request body application/json

/api/auth/verify-email

post /api/auth/verify-email # auth.verifyEmail

Requires Authorization: Bearer <token>.

Request body · required · application/json

{
  token?: string | null
}

Responses

200 object application/json

{
  success: true
  message: string
  user: {
    id: string
    email: string
    name: string | null
    emailVerified: string
  }
}

400 AuthBadRequestEncoded application/json

AuthBadRequestEncoded

401 UnauthorizedEncoded application/json

UnauthorizedEncoded

404 AuthNotFoundEncoded application/json

AuthNotFoundEncoded

500 AuthInternalEncoded application/json

AuthInternalEncoded

SDK example

auth.verifyEmail

import { CadCam } from "@cadcamfun/api/sdk"

const client = CadCam.make({
  baseUrl: process.env.CADCAMFUN_URL!,
  headers: { authorization: `Bearer ${process.env.CADCAMFUN_TOKEN}` },
})

// AuthVerifyEmailInput
const result = await client.auth.verifyEmail({
  token: ""
})

curl

POST /api/auth/verify-email

curl --request POST "${CADCAMFUN_URL}/api/auth/verify-email" \
  --header "Authorization: Bearer ${CADCAMFUN_TOKEN}" \
  --header "Content-Type: application/json" \
  --data-binary @request.json

Try it

Request body application/json

/api/auth/signout

post /api/auth/signout # auth.signout

Requires Authorization: Bearer <token>.

Responses

200 object application/json

{
  success: true
  message: string
}

401 UnauthorizedEncoded application/json

UnauthorizedEncoded

SDK example

auth.signout

import { CadCam } from "@cadcamfun/api/sdk"

const client = CadCam.make({
  baseUrl: process.env.CADCAMFUN_URL!,
  headers: { authorization: `Bearer ${process.env.CADCAMFUN_TOKEN}` },
})

// no input
const result = await client.auth.signout()

curl

POST /api/auth/signout

curl --request POST "${CADCAMFUN_URL}/api/auth/signout" \
  --header "Authorization: Bearer ${CADCAMFUN_TOKEN}"

Try it

/api/auth/get-session

get /api/auth/get-session # auth.getSession

Requires Authorization: Bearer <token>.

Responses

200 object application/json

{
  session: {
    user: {
      id: string
      email: string | null
      name: string | null
      emailVerified: string | null
      createdAt: string
      updatedAt: string
    }
    expires: string
    sessionToken?: string | null
  }
}

401 AuthUnauthorizedEncoded | UnauthorizedEncoded application/json

AuthUnauthorizedEncoded | UnauthorizedEncoded

500 AuthInternalEncoded application/json

AuthInternalEncoded

Example response captured · 200

GET /api/auth/get-session

{
  "session": {
    "user": {
      "id": "c942817d-0162-4291-84ff-77321d387acc",
      "email": "local@cadcamfun.local",
      "name": "Local user",
      "emailVerified": null,
      "createdAt": "2026-10-15T04:52:06.538Z",
      "updatedAt": "2026-10-15T04:52:06.538Z"
    },
    "expires": "2026-10-22T04:52:23.311Z"
  }
}

SDK example

auth.getSession

import { CadCam } from "@cadcamfun/api/sdk"

const client = CadCam.make({
  baseUrl: process.env.CADCAMFUN_URL!,
  headers: { authorization: `Bearer ${process.env.CADCAMFUN_TOKEN}` },
})

// no input
const result = await client.auth.getSession()

curl

GET /api/auth/get-session

curl --request GET "${CADCAMFUN_URL}/api/auth/get-session" \
  --header "Authorization: Bearer ${CADCAMFUN_TOKEN}"

Try it

/api/auth/signin-direct

post /api/auth/signin-direct # auth.signinDirect

Requires Authorization: Bearer <token>.

Request body · required · application/json

{
  email?: string | null
  password?: string | null
}

Responses

200 object application/json

{
  success: true
  message: string
  user: {
    id: string
    email: string | null
    name: string | null
    emailVerified: string | null
    createdAt: string
  }
  token: string
}

400 AuthBadRequestEncoded application/json

AuthBadRequestEncoded

401 AuthUnauthorizedEncoded | UnauthorizedEncoded application/json

AuthUnauthorizedEncoded | UnauthorizedEncoded

404 AuthNotFoundEncoded application/json

AuthNotFoundEncoded

500 AuthInternalEncoded application/json

AuthInternalEncoded

SDK example

auth.signinDirect

import { CadCam } from "@cadcamfun/api/sdk"

const client = CadCam.make({
  baseUrl: process.env.CADCAMFUN_URL!,
  headers: { authorization: `Bearer ${process.env.CADCAMFUN_TOKEN}` },
})

// AuthSigninDirectInput
const result = await client.auth.signinDirect({
  email: "",
  password: ""
})

curl

POST /api/auth/signin-direct

curl --request POST "${CADCAMFUN_URL}/api/auth/signin-direct" \
  --header "Authorization: Bearer ${CADCAMFUN_TOKEN}" \
  --header "Content-Type: application/json" \
  --data-binary @request.json

Try it

Request body application/json

/api/auth/signup

post /api/auth/signup # auth.signup

Requires Authorization: Bearer <token>.

Request body · required · application/json

{
  email?: string | null
  password?: string | null
  confirmPassword?: string | null
  name?: string | null
}

Responses

201 object application/json

{
  success: true
  message: string
  user: {
    id: string
    email: string | null
    name: string | null
    emailVerified: string | null
    createdAt: string
  }
}

400 AuthBadRequestEncoded application/json

AuthBadRequestEncoded

401 UnauthorizedEncoded application/json

UnauthorizedEncoded

500 AuthInternalEncoded application/json

AuthInternalEncoded

SDK example

auth.signup

import { CadCam } from "@cadcamfun/api/sdk"

const client = CadCam.make({
  baseUrl: process.env.CADCAMFUN_URL!,
  headers: { authorization: `Bearer ${process.env.CADCAMFUN_TOKEN}` },
})

// AuthSignupInput
const result = await client.auth.signup({
  email: "",
  password: "",
  confirmPassword: "",
  name: ""
})

curl

POST /api/auth/signup

curl --request POST "${CADCAMFUN_URL}/api/auth/signup" \
  --header "Authorization: Bearer ${CADCAMFUN_TOKEN}" \
  --header "Content-Type: application/json" \
  --data-binary @request.json

Try it

Request body application/json

/api/auth/test-direct-create

post /api/auth/test-direct-create # auth.testDirectCreate

Requires Authorization: Bearer <token>.

Request body · required · application/json

{
  email?: string | null
  password?: string | null
  name?: string | null
}

Responses

201 object application/json

{
  success: true
  message: string
  user: {
    id: string
    email: string | null
    name: string | null
    emailVerified: string | null
    createdAt: string
  }
}

400 TestCreateBadRequestEncoded application/json

TestCreateBadRequestEncoded

401 UnauthorizedEncoded application/json

UnauthorizedEncoded

500 TestCreateFailureEncoded application/json

TestCreateFailureEncoded

SDK example

auth.testDirectCreate

import { CadCam } from "@cadcamfun/api/sdk"

const client = CadCam.make({
  baseUrl: process.env.CADCAMFUN_URL!,
  headers: { authorization: `Bearer ${process.env.CADCAMFUN_TOKEN}` },
})

// AuthTestDirectCreateInput
const result = await client.auth.testDirectCreate({
  email: "",
  password: "",
  name: ""
})

curl

POST /api/auth/test-direct-create

curl --request POST "${CADCAMFUN_URL}/api/auth/test-direct-create" \
  --header "Authorization: Bearer ${CADCAMFUN_TOKEN}" \
  --header "Content-Type: application/json" \
  --data-binary @request.json

Try it

Request body application/json

/api/auth/verify-magic-link

post /api/auth/verify-magic-link # auth.verifyMagicLink

Requires Authorization: Bearer <token>.

Request body · required · application/json

{
  token?: string | null
}

Responses

200 object application/json

{
  success: true
  message: string
  user: {
    id: string
    email: string | null
    name: string | null
  }
  token?: string | null
}

400 AuthBadRequestEncoded application/json

AuthBadRequestEncoded

401 UnauthorizedEncoded application/json

UnauthorizedEncoded

404 AuthNotFoundEncoded application/json

AuthNotFoundEncoded

500 AuthInternalEncoded application/json

AuthInternalEncoded

SDK example

auth.verifyMagicLink

import { CadCam } from "@cadcamfun/api/sdk"

const client = CadCam.make({
  baseUrl: process.env.CADCAMFUN_URL!,
  headers: { authorization: `Bearer ${process.env.CADCAMFUN_TOKEN}` },
})

// AuthVerifyMagicLinkInput
const result = await client.auth.verifyMagicLink({
  token: ""
})

curl

POST /api/auth/verify-magic-link

curl --request POST "${CADCAMFUN_URL}/api/auth/verify-magic-link" \
  --header "Authorization: Bearer ${CADCAMFUN_TOKEN}" \
  --header "Content-Type: application/json" \
  --data-binary @request.json

Try it

Request body application/json

/api/auth/passkey-register

post /api/auth/passkey-register # auth.registerPasskey

Requires Authorization: Bearer <token>.

Responses

200 any JSON value application/json

unknown

401 UnauthorizedEncoded application/json

UnauthorizedEncoded

500 AuthInternalEncoded application/json

AuthInternalEncoded

501 PasskeyNotImplementedEncoded application/json

PasskeyNotImplementedEncoded

SDK example

auth.registerPasskey

import { CadCam } from "@cadcamfun/api/sdk"

const client = CadCam.make({
  baseUrl: process.env.CADCAMFUN_URL!,
  headers: { authorization: `Bearer ${process.env.CADCAMFUN_TOKEN}` },
})

// no input
const result = await client.auth.registerPasskey()

curl

POST /api/auth/passkey-register

curl --request POST "${CADCAMFUN_URL}/api/auth/passkey-register" \
  --header "Authorization: Bearer ${CADCAMFUN_TOKEN}"

Try it

Schemas

Named schemas reachable from this group's parameters, bodies and responses. A ? marks an optional field; | null marks a field that may be present with a null value.

AuthBadRequestEncoded

{
  _tag: "AuthBadRequest"
  error: string
  details: string
}

AuthInternalEncoded

{
  _tag: "AuthInternal"
  error: string
  details: string
}

AuthNotFoundEncoded

{
  _tag: "AuthNotFound"
  error: string
  details: string
}

AuthUnauthorizedEncoded

{
  _tag: "AuthUnauthorized"
  error: string
  details: string
}

PasskeyNotImplementedEncoded

{
  _tag: "PasskeyNotImplemented"
  error: string
  details: string
  todoImplementation: {
    webauthn: string
    challengeGeneration: string
    credentialStorage: string
    userVerification: string
  }
}

TestCreateBadRequestEncoded

{
  _tag: "TestCreateBadRequest"
  error: string
}

TestCreateFailureEncoded

{
  _tag: "TestCreateFailure"
  error: string
  message: string
}

UnauthorizedEncoded

{
  _tag: "Unauthorized"
  message: string
}

Calling this group

Operation ids have the form auth.<name>. The generated Promise SDK (@cadcamfun/api/sdk) exposes most of them as client.<namespace>.<method>(input), where input is one flat object of path parameters and body fields; each card's SDK example shows the exact accessor and input type. Multipart uploads, binary or JavaScript responses and raw webhooks are not generated; those cards show fetch instead.

Errors from the Promise SDK

import { CadCam, ClientError } from "@cadcamfun/api/sdk"

const client = CadCam.make({
  baseUrl: process.env.CADCAMFUN_URL!,
  headers: { authorization: `Bearer ${process.env.CADCAMFUN_TOKEN}` },
})

try {
  await client.projects.list()
} catch (error) {
  if (error instanceof ClientError) {
    // Transport | UnexpectedStatus | UnsupportedContentType | MalformedResponse | SseEventTooLarge
  } else {
    // a declared error body: switch on error._tag
  }
}

Troubleshooting

Symptom	Likely cause	Fix
401 on every call	Token from a previous launch, or missing `Bearer` prefix	Send `Authorization: Bearer <token>` with the token the sidecar was started with.
400 before anything happens	Body or parameter does not match the schema	Compare the payload with the request schema on the card.
403 or 404 on a record you can see elsewhere	The acting account differs	Send the right `x-session-token`, or use the local profile that owns the record.
409	Conflicting state, such as a duplicate name or a stale branch head	Re-read the resource and retry with current data.
Try it says "blocked by CORS"	The docs are served from a non-loopback origin	Run the docs locally or copy the request as curl.
Connection refused	The sidecar restarted on a new port	Read the port from the new `ready` line.