NexAuthDashboard
api reference

REST, predictable, typed

Base URL https://api.nexauth.dev/v1. Keys: pk_* (client), sk_* (server), Bearer header. All errors are { error: { code, message } }.

Auth

POST/v1/otp/sendsend OTP — pk
POST/v1/otp/verifyverify → session — pk
POST/v1/social/googlegoogle id-token → session — pk
POST/v1/password/loginpassword login — pk
POST/v1/magic-link/send | /verifyemail links — pk
POST/v1/passkey/register/* | /login/*WebAuthn — pk
POST/v1/token/refreshrotate refresh — pk
GET/v1/jwks.jsonpublic JWKS — pk

Server

POST/v1/verifyclaims lookup — sk
GET/v1/userslist end users — sk
POST/v1/sessions/revokerevoke session(s) — sk
POST/v1/users/importbulk import w/ hash adapters — sk
POST/v1/users/lazy-loginlegacy-hash login — pk

AuthZ

GET/POST/v1/authz/permissionsperm CRUD — sk
GET/POST/v1/authz/rolesrole CRUD — sk
POST/DELETE/v1/authz/roles/:r/permissions/:pgrant/revoke — sk
POST/DELETE/v1/authz/assignuser↔role w/ scope — sk
POST/v1/authz/checkallow/deny — sk

Admin (console session)

GET/POST/v1/admin/apps | /keysapps + key rotation
GET/PUT/v1/admin/gateways/:providerBYO gateway creds
GET/v1/admin/credits | /usagebalance + metered usage
GET/POST/v1/admin/webhooksendpoints + deliveries
GET/v1/admin/users | /users/:idend-user management
GET/POST/v1/admin/membersteam seats + roles

Webhooks

Events: user.created, session.started, otp.sent, otp.delivered, otp.failed, otp.verified. Payloads are HMAC-SHA256 signed:

verify signature
signature = HMAC_SHA256(whsec, raw_body)
header: X-NexAuth-Signature: sha256=<hex>
// retry: ×8, exponential, 24h window

Rate limits