Authentication overview

Project Authentication is an application-user identity layer. Each project receives its own publishable key, users, identities, sessions, signing key, redirect policy, email delivery, and OAuth Apps.

#Project identity boundary

Identity	Owner	Purpose
HALO account user	HALO	Access the developer dashboard
Project Authentication user	Your project	Sign in to your application
Upstream provider identity	Google, Apple, GitHub, Microsoft	Verify a project user
OAuth App client	Your project	Request scoped access to a signed-in project user

#Email quickstart

1
Configure URLs
Set the site URL and every exact redirect URL the project may use.
2
Configure email
Add a Resend sending key, verified From address, and the three required HTML templates.
3
Copy the publishable key
The dashboard Authentication section displays the project key used by public endpoints.
4
Create a user session
Sign up or sign in, keep the access token short-lived, and rotate the refresh token through the token endpoint.

curl -X POST https://api.agihalo.com/api/v1/auth/signup \
  -H "apikey: $HALO_PROJECT_PUBLISHABLE_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "email": "user@example.com",
    "password": "use-a-strong-password",
    "display_name": "Ada",
    "redirect_to": "https://app.example.com/auth/confirmed"
  }'

#Public API

GET/api/v1/auth/settings

POST/api/v1/auth/signup

POST/api/v1/auth/token?grant_type=password

POST/api/v1/auth/token?grant_type=refresh_token

GET/api/v1/auth/user

POST/api/v1/auth/logout

GET/api/v1/auth/.well-known/jwks.json

#Choose the next guide

Email & Resend

Configure password policy, sender identity, and HTML messages.

Sign-in providers

Sessions & JWT

Validate project-signed access tokens and rotate refresh sessions.

OAuth Apps

Let a service request explicit scopes from a signed-in project user.