Protekt API (1.0.0)

Returns a paginated list of all projects belonging to the authenticated organization.

Create a new Protekt project. A unique login_id is automatically generated and returned.

Retrieve a single project by its ID, including current configuration and generated login_id.

Update one or more configuration fields on an existing project. Only the fields you provide will be changed.

Permanently deletes a project and all associated configuration, users, and sessions. This action is irreversible. All active JWTs issued by this project will be immediately invalidated.

Authenticate with your Protekt account credentials to obtain a Management Token. This token is required for all Account API requests.

Immediately invalidate the current Management Token. Use this when rotating credentials or ending an admin session.

List all API keys for the organization. Key values are never returned — only metadata.

Generate a new API key scoped to a specific project. The raw key value is only returned once at creation time — store it securely.

Permanently revoke an API key. Any service using this key will immediately lose access to the Authentication API.

List all members of the organization with their roles and access levels.

Send an invitation email to add a new member to the organization.

Remove a member from the organization. They immediately lose all dashboard and API access.

Retrieve usage stats for the organization or a specific project, including Monthly Active Users (MAU) and login event counts.

Register a new user with email and password. Protekt hashes and stores credentials internally. Optionally triggers an email verification flow.

Authenticate a user with email and password. Returns a signed JWT and refresh token on success. If MFA is required, returns a mfa_required challenge response instead of tokens.

End a user session by revoking the current access token and its associated refresh token.

Obtain a new access token using a valid refresh token. The old refresh token is rotated and invalidated on each successful call.

Validate an access token and return its decoded claims. Use this on your backend to confirm a user is authenticated before granting access to protected resources.

Immediately invalidate a specific access or refresh token without ending the entire session.

Trigger a password reset email. Protekt sends a one-time reset link to the user's registered email, expiring after 15 minutes. Always returns 200 OK regardless of whether the email exists, to prevent user enumeration attacks.

Complete the password reset flow by submitting the reset token (from the email link) and the new password.

Allow an authenticated user to change their own password by providing their current password and the desired new password.

Send a one-time passcode to a user's email or phone for passwordless authentication or as a second factor. OTPs expire after 10 minutes.

Verify an OTP code sent via POST /auth/otp/send. Returns a JWT and refresh token on success.

Send a magic link to the user's email. When clicked, the link authenticates the user without a password. The link expires after 15 minutes and is single-use.

Verify a magic link token extracted from the URL after the user clicks the emailed link. Returns a JWT and refresh token on success.

Initiate an SSO login flow. Redirects the user to their configured identity provider (IdP). Supports OIDC and SAML 2.0 providers configured in the Protekt Dashboard.

The redirect target for the SSO provider after authentication. Protekt exchanges the authorization code for a session and redirects with tokens. Register https://auth.protekt.io/v1/auth/sso/callback as the callback URL in your IdP configuration.

Begin enrolling a user in MFA. Enrollment is not finalized until the user verifies a code via POST /auth/mfa/verify.

Verify an MFA code. Used both to finalize MFA enrollment and to complete a login challenge. On a successful login challenge, returns a full JWT session.

Remove an MFA method from a user's account. Requires a valid user access token. Returns 403 if the project enforces MFA (mfa_required: true).

List all users registered within a project. Intended for admin/backend use. Requires an API key with users:read scope.

Retrieve a user's full profile by ID, including metadata, MFA status, and account state.

Update a user's profile or metadata. Admins can update any user; users can update their own profile via their access token.

Permanently delete a user and all their sessions, tokens, and stored data from the project. This is irreversible.

List all active sessions for the currently authenticated user, including device, IP address, and last active time.

Revoke all active sessions for the current user — "sign out everywhere". The current session is also terminated unless keep_current is true.

Terminate a specific session by ID. Useful for "sign out this device" functionality.