Passage by 1Password - Auth (Independent Publisher) (Preview)

Passage is backed by 1Password's 17+ years of industry-leading security expertise. Completely replace your existing authentication flow or build from scratch with a robust solution for passwordless authentication and customer identity management. Realize the full security, business, and user experience benefits of eliminating passwords by implementing login flows powered by passkeys, magic links, and login codes.

This connector is available in the following products and regions:

Service	Class	Regions
Logic Apps	Standard	All Logic Apps regions except the following:      -   Azure Government regions      -   Azure China regions      -   US Department of Defense (DoD)
Power Automate	Premium	All Power Automate regions except the following:      -   US Government (GCC)      -   US Government (GCC High)      -   China Cloud operated by 21Vianet      -   US Department of Defense (DoD)
Power Apps	Premium	All Power Apps regions except the following:      -   US Government (GCC)      -   US Government (GCC High)      -   China Cloud operated by 21Vianet      -   US Department of Defense (DoD)

Contact
Name	Troy Taylor
URL	https://www.hitachisolutions.com
Email	ttaylor@hitachisolutions.com

Connector Metadata
Publisher	Troy Taylor
Website	https://passage.1password.com/
Privacy policy	https://storage.googleapis.com/passage-docs/passage-privacy-policy.pdf
Categories	Security

Creating a connection

The connector supports the following authentication types:

Default	Parameters for creating connection.	All regions	Not shareable

Default

Applicable: All regions

Parameters for creating connection.

This is not shareable connection. If the power app is shared with another user, another user will be prompted to create new connection explicitly.

Name	Type	Description	Required
API Key (in the form 'Bearer YOUR_API_KEY')	securestring	The API Key (in the form 'Bearer YOUR_API_KEY') for this api	True

Throttling Limits

Name	Calls	Renewal Period
API calls per connection	100	60 seconds

Actions

Authenticate magic link	Authenticates a magic link for a user. This endpoint checks that the magic link is valid, then returns an authentication token for the user.
Authenticate OTP	Authenticates a one-time passcode for a user. This endpoint checks that the one-time passcode is valid, then returns an authentication token for the user.
Change email	Initiate an email change for the authenticated user. An email change requires verification, so an email will be sent to the user which they must verify before the email change takes effect.
Change Phone	Initiate a phone number change for the authenticated user. A phone number change requires verification, so an SMS with a link will be sent to the user which they must verify before the phone number change takes effect.
Create new auth and refresh token	Creates and returns a new auth token and a new refresh token.
Create user	Create a user.
Delete social connection	Deletes a social connection for the current user. User must be authenticated via a bearer token.
Exchange OAuth2 for auth token	Exchanges OAuth2 connection data for an auth token.
Finish WebAuthn add device	Completes a WebAuthn add device operation for the current user. User must be authenticated via a bearer token.
Finish WebAuthn login	Completes a WebAuthn login and authenticate the user.
Finish WebAuthn registration	Completes a WebAuthn registration and authenticate the user.
Get app	Retrieve information about an application.
Get current user	Retrieve information about a user that is currently authenticated via bearer token.
Get JWKS	Retrieve JWKS for an app. KIDs in the JWT can be used to match the appropriate JWK, and use the JWK's public key to verify the JWT.
Get OpenID configuration	Retrieve OpenID configuration for an app.
Get social connections	Gets social connections for the current user. User must be authenticated via a bearer token.
Get user	Retrieve user information, if the user exists. This endpoint can be used to determine whether a user has an existing account and if they should login or register.
Get user's metadata	Retrieve the user-metadata for the current user.
Handle OAuth2 callback	Handles an OAuth2 flow callback.
Link an account to a connection	Links an existing account to an OAuth2 connection.
List devices	Retrieve a list of all WebAuthn devices for the authenticated user. User must be authenticated via bearer token.
Login with magic link	Send a login email or SMS to the user. The user will receive an email or text with a link to complete their login.
Login with OTP	Send a login email or SMS to the user. The user will receive an email or text with a one-time passcode to complete their login.
Magic link status	Check if a magic link has been activated yet or not. Once the magic link has been activated, this endpoint will return an authentication token for the user. This endpoint can be used to initiate a login on one device and then poll and wait for the login to complete on another device.
Register with magic link	Create a user and send an registration email or SMS to the user. The user will receive an email or text with a link to complete their registration.
Register with OTP	Create a user and send a registration email or SMS to the user. The user will receive an email or text with a one-time passcode to complete their registration.
Revoke device	Revoke a device by ID for the current user. User must be authenticated via a bearer token.
Revoke refresh token	Revokes the refresh token.
Start OAuth2 flow	Kicks off an OAuth2 flow with connection provider request params described in https://openid.net/specs/openid-connect-core-1_0.html#AuthRequest
Start WebAuthn add device	Initiate a WebAuthn add device operation for the current user. This endpoint creates a WebAuthn credential creation challenge that is used to perform the registration ceremony from the browser. User must be authenticated via a bearer token.
Start WebAuthn login	Initiate a WebAuthn login for a user. This endpoint creates a WebAuthn credential assertion challenge that is used to perform the login ceremony from the browser.
Start WebAuthn registration	Initiate a WebAuthn registration and create the user. This endpoint creates a WebAuthn credential creation challenge that is used to perform the registration ceremony from the browser.
Update device	Updates a device by ID for the current user. Currently the only field that can be updated is the friendly name. User must be authenticated via a bearer token.
Update user's metadata	Updates the metadata for the current user. Only valid metadata fields are accepted. Invalid metadata fields that are present will abort the update. User must be authenticated via a bearer token.

Authenticate magic link

Operation ID:

Activate-magic-link

Authenticates a magic link for a user. This endpoint checks that the magic link is valid, then returns an authentication token for the user.

Parameters

Name	Key	Required	Type	Description
App ID	app_id	True	string	App ID.
Magic Link	magic_link	True	string	The magic link.

Returns

Body

AuthResponse

Authenticate OTP

Operation ID:

Activate-one-time-passcode

Authenticates a one-time passcode for a user. This endpoint checks that the one-time passcode is valid, then returns an authentication token for the user.

Parameters

Name	Key	Required	Type	Description
App ID	app_id	True	string	App ID.
OTP	otp	True	string	The one-time passcode.
OTP ID	otp_id	True	string	The ID of the one-time passcode.

Returns

Body

AuthResponse

Change email

Operation ID:

Update-email-currentuser

Initiate an email change for the authenticated user. An email change requires verification, so an email will be sent to the user which they must verify before the email change takes effect.

Parameters

Name	Key	Required	Type	Description
App ID	app_id	True	string	App ID.
Language	language		string	The language of the email to send (optional).
Magic Link Path	magic_link_path		string	The magic link path.
New Email	new_email	True	string	The new email.
Redirect URL	redirect_url		string	The redirect URL address.

Returns

Body

MagicLinkResponse

Change Phone

Operation ID:

Update-phone-currentuser

Initiate a phone number change for the authenticated user. A phone number change requires verification, so an SMS with a link will be sent to the user which they must verify before the phone number change takes effect.

Parameters

Name	Key	Required	Type	Description
App ID	app_id	True	string	App ID.
Language	language		string	Language of the email to send (optional).
Magic Link Path	magic_link_path		string	The magic link path.
New Phone	new_phone		string	The new phone number.
Redirect URL	redirect_url		string	The redirect URL address.

Returns

Body

MagicLinkResponse

Create new auth and refresh token

Operation ID:

Refresh-auth-token

Creates and returns a new auth token and a new refresh token.

Parameters

Name	Key	Required	Type	Description
App ID	app_id	True	string	App ID.
Refresh Token	refresh_token	True	string	The refresh token.

Returns

Body

AuthResponse

Create user

Operation ID:

Create-user

Create a user.

Parameters

Name	Key	Required	Type	Description
App ID	app_id	True	string	App ID.
ID	identifier	True	string	The identifier.

Returns

Body

UserResponse

Delete social connection

Operation ID:

Delete-currentuser-social-connection

Deletes a social connection for the current user. User must be authenticated via a bearer token.

Parameters

Name	Key	Required	Type	Description
App ID	app_id	True	string	App ID.
Social Connection Type	social_connection_type	True	string	The type of social connection.

Exchange OAuth2 for auth token

Operation ID:

Exchange-social-token

Exchanges OAuth2 connection data for an auth token.

Parameters

Name	Key	Required	Type	Description
App ID	app_id	True	string	App ID.
OAuth2 Code	code	True	string	The code given from the OAuth2 redirect.
Verifier	verifier	True	string	The verifier the client originally sent to the OAuth2 provider.

Returns

Body

AuthResponse

Finish WebAuthn add device

Operation ID:

Post-currentuser-add-device-finish

Completes a WebAuthn add device operation for the current user. User must be authenticated via a bearer token.

Parameters

Name	Key	Required	Type	Description
App ID	app_id	True	string	App ID.
Handshake ID	handshake_id	True	string	The handshake identifier.
Authenticator Attachment	authenticatorAttachment		string	The authenticator attachment.
ID	id		string	The credential's identifier. The requirements for the identifier are distinct for each type of credential. It might represent a username for username/password tuples, for example.
Raw ID	rawId		string	The raw identifier.
Attestation Object	attestationObject		string	Attestation object is the byte slice version of attestationObject. This attribute contains an attestation object, which is opaque to, and cryptographically protected against tampering by, the client. The attestation object contains both authenticator data and an attestation statement. The former contains the AAGUID, a unique credential ID, and the credential public key. The contents of the attestation statement are determined by the attestation statement format used by the authenticator. It also contains any additional information that the relying party's server requires to validate the attestation statement, as well as to decode and validate the authenticator data along with the JSON-serialized client data.
Client Data JSON	clientDataJSON		string	This attribute contains a JSON serialization of the client data passed to the authenticator by the client in its call to either create() or get().
Transports	transports		array of string	The transports.
Transports	transports		array of string	The transports.
Type	type		string	The value of the object's interface object's [[type]] slot, which specifies the credential type represented by this object. This should be type "public-key" for Webauthn credentials.
User ID	user_id	True	string	The user identifier.

Returns

Body

CurrentUserDevice

Finish WebAuthn login

Operation ID:

Login-webauthn-finish

Completes a WebAuthn login and authenticate the user.

Parameters

Name	Key	Required	Type	Description
App ID	app_id	True	string	App ID.
Handshake ID	handshake_id	True	string	The handshake identifier.
Authenticator Attachment	authenticatorAttachment		string	The authenticator attachment.
ID	id		string	The credential's identifier. The requirements for the identifier are distinct for each type of credential. It might represent a username for username/password tuples, for example.
Raw ID	rawId		string	The raw identifier.
Authenticator Data	authenticatorData		string	The authenticator data.
Client Data JSON	clientDataJSON		string	This attribute contains a JSON serialization of the client data passed to the authenticator by the client in its call to either create() or get().
Signature	signature		string	The signature.
User	userHandle		string	The user handle.
Type	type		string	The value of the object's interface object's [[type]] slot, which specifies the credential type represented by this object. This should be type "public-key" for Webauthn credentials.
User ID	user_id		string	The user identifier.

Returns

Body

AuthResponse

Finish WebAuthn registration

Operation ID:

Register-webauthn-finish

Completes a WebAuthn registration and authenticate the user.

Parameters

Name	Key	Required	Type	Description
App ID	app_id	True	string	App ID.
Handshake ID	handshake_id	True	string	The handshake identifier.
Authenticator Attachment	authenticatorAttachment		string	The authenticator attachment.
ID	id		string	The credential's identifier. The requirements for the identifier are distinct for each type of credential. It might represent a username for username/password tuples, for example.
Raw ID	rawId		string	The raw identifier.
Attestation Object	attestationObject		string	Attestation object is the byte slice version of attestationObject. This attribute contains an attestation object, which is opaque to, and cryptographically protected against tampering by, the client. The attestation object contains both authenticator data and an attestation statement. The former contains the AAGUID, a unique credential ID, and the credential public key. The contents of the attestation statement are determined by the attestation statement format used by the authenticator. It also contains any additional information that the relying party's server requires to validate the attestation statement, as well as to decode and validate the authenticator data along with the JSON-serialized client data.
Client Data JSON	clientDataJSON		string	This attribute contains a JSON serialization of the client data passed to the authenticator by the client in its call to either create() or get().
Transports	transports		array of string	The transports.
Transports	transports		array of string	The transports.
Type	type		string	The value of the object's interface object's [[type]] slot, which specifies the credential type represented by this object. This should be type "public-key" for Webauthn credentials.
User ID	user_id	True	string	The user identifier.

Returns

Body

AuthResponse

Get app

Operation ID:

Get-app

Retrieve information about an application.

Parameters

Name	Key	Required	Type	Description
App ID	app_id	True	string	App ID.

Returns

Body

GetAppResponse

Get current user

Operation ID:

Get-currentuser

Retrieve information about a user that is currently authenticated via bearer token.

Parameters

Name	Key	Required	Type	Description
App ID	app_id	True	string	App ID.

Returns

Body

CurrentUserResponse

Get JWKS

Operation ID:

Get-jwks

Retrieve JWKS for an app. KIDs in the JWT can be used to match the appropriate JWK, and use the JWK's public key to verify the JWT.

Parameters

Name	Key	Required	Type	Description
App ID	app_id	True	string	App ID.

Returns

Body

JWKResponse

Get OpenID configuration

Operation ID:

Get-open-id-configuration

Retrieve OpenID configuration for an app.

Parameters

Name	Key	Required	Type	Description
App ID	app_id	True	string	App ID.

Returns

Body

OpenIdConfiguration

Get social connections

Operation ID:

Get-currentuser-social-connections

Gets social connections for the current user. User must be authenticated via a bearer token.

Parameters

Name	Key	Required	Type	Description
App ID	app_id	True	string	App ID.

Returns

Body

SocialConnectionsResponse

Get user

Operation ID:

Check-user-identifier

Retrieve user information, if the user exists. This endpoint can be used to determine whether a user has an existing account and if they should login or register.

Parameters

Name	Key	Required	Type	Description
App ID	app_id	True	string	App ID.
Email or Phone	identifier	True	string	Email or phone number.

Returns

Body

UserResponse

Get user's metadata

Operation ID:

Get-currentuser-metadata

Retrieve the user-metadata for the current user.

Parameters

Name	Key	Required	Type	Description
App ID	app_id	True	string	App ID.

Returns

Body

UserMetadataResponse

Handle OAuth2 callback

Operation ID:

Oauth2-callback

Handles an OAuth2 flow callback.

Parameters

Name	Key	Required	Type	Description
App ID	app_id	True	string	App ID.
OAuth2 Code	code	True	string	The authorization code returned by the OAuth2 provider.
State	state		string	The state returned by the OAuth2 provider.
Error	error		string	The error returned by the OAuth2 provider.
Error	error_description		string	The error description returned by the OAuth2 provider.

Returns

Link an account to a connection

Operation ID:

Currentuser-social-link-account

Links an existing account to an OAuth2 connection.

Parameters

Name	Key	Required	Type	Description
App ID	app_id	True	string	App ID.
OAuth2 Code	code	True	string	The code given from the OAuth2 redirect.
Verifier	verifier	True	string	The verifier the client originally sent to the OAuth2 provider.

List devices

Operation ID:

Get-currentuser-devices

Retrieve a list of all WebAuthn devices for the authenticated user. User must be authenticated via bearer token.

Parameters

Name	Key	Required	Type	Description
App ID	app_id	True	string	App ID.

Returns

Body

CurrentUserDevices

Login with magic link

Operation ID:

Login-magic-link

Send a login email or SMS to the user. The user will receive an email or text with a link to complete their login.

Parameters

Name	Key	Required	Type	Description
App ID	app_id	True	string	App ID.
ID	identifier	True	string	Valid email or E164 phone number.
Language	language		string	Language of the email or SMS to send (optional).
Magic Link Path	magic_link_path		string	Path relative to the app's auth_origin (optional).

Returns

Body

LoginMagicLinkResponse

Login with OTP

Operation ID:

Login-one-time-passcode

Send a login email or SMS to the user. The user will receive an email or text with a one-time passcode to complete their login.

Parameters

Name	Key	Required	Type	Description
App ID	app_id	True	string	App ID.
ID	identifier	True	string	Valid email or E164 phone number.
Language	language		string	Language of the email to send (optional).

Returns

Body

OneTimePasscodeResponse

Magic link status

Operation ID:

Magic-link-status

Check if a magic link has been activated yet or not. Once the magic link has been activated, this endpoint will return an authentication token for the user. This endpoint can be used to initiate a login on one device and then poll and wait for the login to complete on another device.

Parameters

Name	Key	Required	Type	Description
App ID	app_id	True	string	App ID.
ID	id	True	string	The identifier.

Returns

Body

AuthResponse

Register with magic link

Operation ID:

Register-magic-link

Create a user and send an registration email or SMS to the user. The user will receive an email or text with a link to complete their registration.

Parameters

Name	Key	Required	Type	Description
App ID	app_id	True	string	App ID.
ID	identifier	True	string	Valid email or E164 phone number.
Language	language		string	Language of the email or SMS to send (optional).
Magic Link Path	magic_link_path		string	Path relative to the app's auth_origin (optional).

Returns

Body

RegisterMagicLinkResponse

Register with OTP

Operation ID:

Register-one-time-passcode

Create a user and send a registration email or SMS to the user. The user will receive an email or text with a one-time passcode to complete their registration.

Parameters

Name	Key	Required	Type	Description
App ID	app_id	True	string	App ID.
ID	identifier	True	string	Valid email or E164 phone number.
Language	language		string	Language of the email to send (optional).

Returns

Body

OneTimePasscodeResponse

Revoke device

Operation ID:

Delete-currentuser-device

Revoke a device by ID for the current user. User must be authenticated via a bearer token.

Parameters

Name	Key	Required	Type	Description
App ID	app_id	True	string	App ID.
Device ID	device_id	True	string	Device ID.

Revoke refresh token

Operation ID:

Revoke-refresh-token

Revokes the refresh token.

Parameters

Name	Key	Required	Type	Description
App ID	app_id	True	string	App ID.
Refresh Token	refresh_token	True	string	Refresh token.

Start OAuth2 flow

Operation ID:

Get-authorize

Kicks off an OAuth2 flow with connection provider request params described in https://openid.net/specs/openid-connect-core-1_0.html#AuthRequest

Parameters

Name	Key	Required	Type	Description
App ID	app_id	True	string	App ID.
Redirect URI	redirect_uri	True	string	The URL to redirect to after the OAuth2 flow is complete.
State	state		string	The state to pass through to the redirect URI.
Code Challenge	code_challenge	True	string	Code challenge.
Code Challenge Method	code_challenge_method	True	string	Code challenge method.
Connection Type	connection_type	True	string	Connection type; google, github, apple, or passage to login with.

Returns

Start WebAuthn add device

Operation ID:

Post-currentuser-add-device-start

Initiate a WebAuthn add device operation for the current user. This endpoint creates a WebAuthn credential creation challenge that is used to perform the registration ceremony from the browser. User must be authenticated via a bearer token.

Parameters

Name	Key	Required	Type	Description
App ID	app_id	True	string	App ID.
Authenticator Attachment	authenticator_attachment		string	Selects the type of authentication that will be used in this WebAuthN flow request.

Returns

Body

AddDeviceStartResponse

Start WebAuthn login

Operation ID:

Login-webauthn-start

Initiate a WebAuthn login for a user. This endpoint creates a WebAuthn credential assertion challenge that is used to perform the login ceremony from the browser.

Parameters

Name	Key	Required	Type	Description
App ID	app_id	True	string	App ID.
ID	identifier		string	Valid email or E164 phone number.

Returns

Body

LoginWebAuthnStartResponse

Start WebAuthn registration

Operation ID:

Register-webauthn-start

Initiate a WebAuthn registration and create the user. This endpoint creates a WebAuthn credential creation challenge that is used to perform the registration ceremony from the browser.

Parameters

Name	Key	Required	Type	Description
App ID	app_id	True	string	App ID.
ID	identifier	True	string	Valid email or E164 phone number.
Authenticator Attachment	authenticator_attachment		string	Selects the type of authentication that will be used in this WebAuthN flow request.

Returns

Body

RegisterWebAuthnStartResponse

Update device

Operation ID:

Update-currentuser-device

Updates a device by ID for the current user. Currently the only field that can be updated is the friendly name. User must be authenticated via a bearer token.

Parameters

Name	Key	Required	Type	Description
App ID	app_id	True	string	App ID.
Device ID	device_id	True	string	Device ID.
Friendly Name	friendly_name	True	string	The friendly name.

Returns

Body

CurrentUserDevice

Update user's metadata

Operation ID:

Update-currentuser-metadata

Updates the metadata for the current user. Only valid metadata fields are accepted. Invalid metadata fields that are present will abort the update. User must be authenticated via a bearer token.

Parameters

Name	Key	Required	Type	Description
App ID	app_id	True	string	App ID.

Returns

Body

CurrentUserResponse

Definitions

GetAppResponse

Name	Path	Type	Description
app	app	App

LayoutConfig

Name	Path	Type	Description
H	h	integer	The H value.
ID	id	string	The identifier.
W	w	integer	The W value.
X	x	integer	The X value.
Y	y	integer	The Y value.

Layouts

Name	Path	Type	Description
Profile	profile	array of LayoutConfig
Registration	registration	array of LayoutConfig

UserMetadataField

Name	Path	Type	Description
Field Name	field_name	string	The field name.
Friendly Name	friendly_name	string	The friendly name.
ID	id	string	The identifier.
Profile	profile	boolean	Whether profile.
Registration	registration	boolean	Whether registration.
Type	type	string	The type.

App

Name	Path	Type	Description
Allowed ID	allowed_identifier	string	The allowed identifier.
Auth Fallback Method	auth_fallback_method	string	Deprecated Property. Please refer to auth_methods to view settings for individual authentication methods.
Auth Fallback Method TTL	auth_fallback_method_ttl	integer	Deprecated Property. Please refer to auth_methods to view settings for individual authentication methods.
Auth Methods	auth_methods	AuthMethods	Denotes what methods this app is allowed to use for authentication with configurations.
Auth Origin	auth_origin	string	The auth origin.
Default Language	default_language	string	The default language.
element_customization	element_customization	ElementCustomization
element_customization_dark	element_customization_dark	ElementCustomization
Ephemeral	ephemeral	boolean	Whether ephemeral.
ID	id	string	The identifier.
layouts	layouts	Layouts
Login URL	login_url	string	The login URL address.
Name	name	string	The name.
Passage Branding	passage_branding	boolean	Whether to use Passage branding.
Public Signup	public_signup	boolean	Whether public signup.
Profile Management	profile_management	boolean	Whether profile management.
Redirect URL	redirect_url	string	The redirect URL address.
Email Verification	require_email_verification	boolean	Whether to require email verification.
ID Verification	require_identifier_verification	boolean	Whether to require identifier verification.
Required ID	required_identifier	string	The required identifier.
RSA Public Key	rsa_public_key	string	The RSA public key.
Session Timeout	session_timeout_length	integer	The session timeout length.
social_connections	social_connections	SocialConnections
User Metadata Schema	user_metadata_schema	array of UserMetadataField

SocialConnections

Name	Path	Type	Description
google	google	SocialConnection
github	github	SocialConnection

SocialConnection

Name	Path	Type	Description
Client ID	client_id	string	The client ID of the OAuth2 social connection.

ElementCustomization

Name	Path	Type	Description
Passage Container Background Color	passage_container_background_color	string	Container background color in hex. Default is #ffffff in light mode & #383838 in dark mode.
Passage Container Max Width	passage_container_max_width	integer	Maximum width of container (px).
Passage Input Box Background Color	passage_input_box_background_color	string	Input box background color in hex. Default is #ffffff in light mode & #4b4b4b in dark mode.
Passage Input Box Border Radius	passage_input_box_border_radius	integer	Input box border radius (px).
Font	passage_header_font_family	FontFamily	Body font family.
Font	passage_body_font_family	FontFamily	Body font family.
Passage Header Text Color	passage_header_text_color	string	Header text color in hex. Default is #222222 in light mode & #f3f3f3 in dark mode.
Passage Body Text Color	passage_body_text_color	string	Body text color in hex. Default is #222222 in light mode & #f3f3f3 in dark mode.
Passage Primary Button Background Color	passage_primary_button_background_color	string	Primary button background color (hex).
Passage Primary Button Text Color	passage_primary_button_text_color	string	Primary button font color (hex).
Passage Primary Button Hover Color	passage_primary_button_hover_color	string	Primary button background on hover (hex).
Passage Primary Button Border Radius	passage_primary_button_border_radius	integer	Primary button border radius (px).
Passage Primary Button Border Color	passage_primary_button_border_color	string	Primary button border color.
Passage Primary Button Border Width	passage_primary_button_border_width	integer	Primary button border width (px).
Passage Secondary Button Background Color	passage_secondary_button_background_color	string	Secondary button background color (hex).
Passage Secondary Secondary Buttn Text Color	passage_secondary_button_text_color	string	Secondary button font color (hex).
Passage Secondary Button Backgroun on Hover	passage_secondary_button_hover_color	string	Secondary button background on hover (hex).
Passage Secondary Button Border Radius	passage_secondary_button_border_radius	integer	Secondary button border radius (px).
Passage Secondary Button Border Color	passage_secondary_button_border_color	string	Secondary button border color.
Passage Secondary Button Border Width	passage_secondary_button_border_width	integer	Secondary button border width (px).

FontFamily

Body font family.

Body font family.

Font

string

AuthMethods

Denotes what methods this app is allowed to use for authentication with configurations.

Name	Path	Type	Description
Passkeys Auth Method	passkeys	PasskeysAuthMethod	The passkeys auth method object.
otp	otp	OtpAuthMethod
magic_link	magic_link	MagicLinkAuthMethod

PasskeysAuthMethod

The passkeys auth method object.

Name	Path	Type	Description
Passkeys Auth Method		object	The passkeys auth method object.

OtpAuthMethod

Name	Path	Type	Description
TTL	ttl	integer	Maximum time (IN SECONDS) for the auth to expire.
TTL Display Unit	ttl_display_unit	TtlDisplayUnit	Deprecated Property. The preferred unit for displaying the TTL. This value is for display only. * s - seconds * m - minutes * h - hours * d - days .

MagicLinkAuthMethod

Name	Path	Type	Description
TTL	ttl	integer	Maximum time (IN SECONDS) for the auth to expire.
TTL Display Unit	ttl_display_unit	TtlDisplayUnit	Deprecated Property. The preferred unit for displaying the TTL. This value is for display only. * s - seconds * m - minutes * h - hours * d - days .

TtlDisplayUnit

Deprecated Property. The preferred unit for displaying the TTL. This value is for display only. * s - seconds * m - minutes * h - hours * d - days .

Deprecated Property. The preferred unit for displaying the TTL. This value is for display only. * s - seconds * m - minutes * h - hours * d - days .

TTL Display Unit

string

JWKResponse

Name	Path	Type	Description
JWK Response Keys	keys	array of JWKResponse_keys

OpenIdConfiguration

Name	Path	Type	Description
Authorization Endpoint	authorization_endpoint	string	The authorization endpoint.
Issuer	issuer	string	The issuer.
JWKs URI	jwks_uri	string	The JWKs URI.

CurrentUserResponse

Name	Path	Type	Description
user	user	CurrentUser

Credential

Name	Path	Type	Description
Created at	created_at	string	The first time this webAuthn device was used to authenticate the user.
Cred ID	cred_id	string	The Cred ID for this webAuthn device (encoded to match what is stored in psg_cred_obj).
Friendly Name	friendly_name	string	The friendly name for the webAuthn device used to authenticate.
ID	id	string	The ID of the webAuthn device used for authentication.
Last Login At	last_login_at	string	The last time this webAuthn device was used to authenticate the user.
WebAuthn Type	type	WebAuthnType	The type of this credential.
Updated At	updated_at	string	The last time this webAuthn device was updated.
Usage Count	usage_count	integer	How many times this webAuthn device has been used to authenticate the user.
User ID	user_id	string	The userID for this webAuthn device.
icons	icons	WebAuthnIcons	Contains the light and dark SVG icons that represent the brand of those devices Values can be null or base64 encoded SVG. Example of SVG output: data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIGVuYWJsZS1iYWNrZ3JvdW5kPSJuZXcgMCAwIDE5MiAxOTIiIGhlaWdodD0iMjRweCIgdmlld0JveD0iMCAwIDE5MiAxOTIiIHdpZHRoPSIyNHB4Ij48cmVjdCBmaWxsPSJub25lIiBoZWlnaHQ9IjE5MiIgd2lkdGg9IjE5MiIgeT0iMCIvPjxnPjxwYXRoIGQ9Ik02OS4yOSwxMDZjLTMuNDYsNS45Ny05LjkxLDEwLTE3LjI5LDEwYy0xMS4wMywwLTIwLTguOTctMjAtMjBzOC45Ny0yMCwyMC0yMCBjNy4zOCwwLDEzLjgzLDQuMDMsMTcuMjksMTBoMjUuNTVDOTAuMyw2Ni41NCw3Mi44Miw1Miw1Miw1MkMyNy43NCw1Miw4LDcxLjc0LDgsOTZzMTkuNzQsNDQsNDQsNDRjMjAuODIsMCwzOC4zLTE0LjU0LDQyLjg0LTM0IEg2OS4yOXoiIGZpbGw9IiM0Mjg1RjQiLz48cmVjdCBmaWxsPSIjRkJCQzA0IiBoZWlnaHQ9IjI0IiB3aWR0aD0iNDQiIHg9Ijk0IiB5PSI4NCIvPjxwYXRoIGQ9Ik05NC4zMiw4NEg2OHYwLjA1YzIuNSwzLjM0LDQsNy40Nyw0LDExLjk1cy0xLjUsOC42MS00LDExLjk1VjEwOGgyNi4zMiBjMS4wOC0zLjgyLDEuNjgtNy44NCwxLjY4LTEyUzk1LjQxLDg3LjgyLDk0LjMyLDg0eiIgZmlsbD0iI0VBNDMzNSIvPjxwYXRoIGQ9Ik0xODQsMTA2djI2aC0xNnYtOGMwLTQuNDItMy41OC04LTgtOHMtOCwzLjU4LTgsOHY4aC0xNnYtMjZIMTg0eiIgZmlsbD0iIzM0QTg1MyIvPjxyZWN0IGZpbGw9IiMxODgwMzgiIGhlaWdodD0iMjQiIHdpZHRoPSI0OCIgeD0iMTM2IiB5PSI4NCIvPjwvZz48L3N2Zz4=

CurrentUser

Name	Path	Type	Description
Created At	created_at	string	When this user was created.
Email	email	string	The user's email.
Email Verified	email_verified	boolean	Whether or not the user's email has been verified.
ID	id	string	The user ID.
Last Login At	last_login_at	string	The last time this user logged in.
Login Count	login_count	integer	How many times the user has successfully logged in.
Phone	phone	string	The user's phone.
Phone Verified	phone_verified	boolean	Whether or not the user's phone has been verified.
social_connections	social_connections	UserSocialConnections
User Status	status	UserStatus	User status: active, inactive, pending.
Updated At	updated_at	string	When this user was last updated.
WebAuthn	webauthn	boolean	Whether or not the user has authenticated via webAuthn before (if len(WebAuthnDevices) > 0).
WebAuthn Devices	webauthn_devices	array of Credential	The list of devices this user has authenticated with via webAuthn.
WebAuthn Types	webauthn_types	array of WebAuthnType	Retrieve a list of credential types that the user has created.

CurrentUserDevices

Name	Path	Type	Description
Devices	devices	array of Credential

CurrentUserDevice

Name	Path	Type	Description
device	device	Credential

AddDeviceStartResponse

Name	Path	Type	Description
handshake	handshake	CredentialCreationChallenge
user	user	User

MagicLinkResponse

Name	Path	Type	Description
magic_link	magic_link	MagicLink

MagicLink

Name	Path	Type	Description
ID	id	string	The magic link identifier.

UserMetadataResponse

LoginMagicLinkResponse

Name	Path	Type	Description
magic_link	magic_link	MagicLink

RegisterMagicLinkResponse

Name	Path	Type	Description
magic_link	magic_link	MagicLink

UserResponse

Name	Path	Type	Description
user	user	User

LoginWebAuthnStartResponse

Name	Path	Type	Description
handshake	handshake	CredentialAssertionChallenge
user	user	User

CredentialAssertionChallenge

Name	Path	Type	Description
challenge	challenge	protocol.CredentialAssertion
ID	id	string	The identifier.

protocol.CredentialAssertion

Name	Path	Type	Description
publicKey	publicKey	protocol.CredentialAssertion_publicKey

WebAuthnIcons

Contains the light and dark SVG icons that represent the brand of those devices Values can be null or base64 encoded SVG. Example of SVG output: data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIGVuYWJsZS1iYWNrZ3JvdW5kPSJuZXcgMCAwIDE5MiAxOTIiIGhlaWdodD0iMjRweCIgdmlld0JveD0iMCAwIDE5MiAxOTIiIHdpZHRoPSIyNHB4Ij48cmVjdCBmaWxsPSJub25lIiBoZWlnaHQ9IjE5MiIgd2lkdGg9IjE5MiIgeT0iMCIvPjxnPjxwYXRoIGQ9Ik02OS4yOSwxMDZjLTMuNDYsNS45Ny05LjkxLDEwLTE3LjI5LDEwYy0xMS4wMywwLTIwLTguOTctMjAtMjBzOC45Ny0yMCwyMC0yMCBjNy4zOCwwLDEzLjgzLDQuMDMsMTcuMjksMTBoMjUuNTVDOTAuMyw2Ni41NCw3Mi44Miw1Miw1Miw1MkMyNy43NCw1Miw4LDcxLjc0LDgsOTZzMTkuNzQsNDQsNDQsNDRjMjAuODIsMCwzOC4zLTE0LjU0LDQyLjg0LTM0IEg2OS4yOXoiIGZpbGw9IiM0Mjg1RjQiLz48cmVjdCBmaWxsPSIjRkJCQzA0IiBoZWlnaHQ9IjI0IiB3aWR0aD0iNDQiIHg9Ijk0IiB5PSI4NCIvPjxwYXRoIGQ9Ik05NC4zMiw4NEg2OHYwLjA1YzIuNSwzLjM0LDQsNy40Nyw0LDExLjk1cy0xLjUsOC42MS00LDExLjk1VjEwOGgyNi4zMiBjMS4wOC0zLjgyLDEuNjgtNy44NCwxLjY4LTEyUzk1LjQxLDg3LjgyLDk0LjMyLDg0eiIgZmlsbD0iI0VBNDMzNSIvPjxwYXRoIGQ9Ik0xODQsMTA2djI2aC0xNnYtOGMwLTQuNDItMy41OC04LTgtOHMtOCwzLjU4LTgsOHY4aC0xNnYtMjZIMTg0eiIgZmlsbD0iIzM0QTg1MyIvPjxyZWN0IGZpbGw9IiMxODgwMzgiIGhlaWdodD0iMjQiIHdpZHRoPSI0OCIgeD0iMTM2IiB5PSI4NCIvPjwvZz48L3N2Zz4=

Name	Path	Type	Description
Light Icon	light	string	The light icon.
Dark Icon	dark	string	The dark icon.

OneTimePasscodeResponse

Name	Path	Type	Description
OTP ID	otp_id	string	The ID of the one-time passcode. Provide it when activating.

RegisterWebAuthnStartResponse

Name	Path	Type	Description
handshake	handshake	CredentialCreationChallenge
user	user	User

SocialConnectionsResponse

Name	Path	Type	Description
social_connections	social_connections	UserSocialConnections

GoogleSocialConnection

Name	Path	Type	Description
Provider ID	provider_id	string	The external ID of the social connection.
Created At	created_at	date-time	When created at.
Last Login At	last_login_at	date-time	The last login at.
Provider ID	provider_identifier	string	The email of connected social user.

GithubSocialConnection

Name	Path	Type	Description
Provider ID	provider_id	string	The external ID of the social connection.
Created At	created_at	date-time	When created at.
Last Login At	last_login_at	date-time	The last login at.
Provider ID	provider_identifier	string	The email of connected social user.

UserSocialConnections

Name	Path	Type	Description
google	google	GoogleSocialConnection
github	github	GithubSocialConnection

UserStatus

User status: active, inactive, pending.

User status: active, inactive, pending.

User Status

string

WebAuthnType

The type of this credential.

The type of this credential.

WebAuthn Type

string

CredentialCreation

Name	Path	Type	Description
publicKey	publicKey	CredentialCreation_publicKey

CredentialCreationChallenge

Name	Path	Type	Description
challenge	challenge	CredentialCreation
ID	id	string	The identifier.

User

Name	Path	Type	Description
Email	email	string	The email address.
Email Verified	email_verified	boolean	Whether or not the user's email has been verified.
ID	id	string	The identifier.
Phone	phone	string	The phone number.
Phone Verified	phone_verified	boolean	Whether or not the user's phone has been verified.
User Status	status	UserStatus	User status: active, inactive, pending.
WebAuthn Verified	webauthn	boolean	Whether WebAuthn is verified.
WebAuthn Types	webauthn_types	array of WebAuthnType

AuthResult

Name	Path	Type	Description
Auth Token	auth_token	string	The auth token.
Redirect URL	redirect_url	string	The redirect URL address.
Refresh Token	refresh_token	string	The refresh token.
Refresh Token Expiration	refresh_token_expiration	integer	The refresh token expiration.

AuthResponse

Name	Path	Type	Description
auth_result	auth_result	AuthResult

JWKResponse_keys

Name	Path	Type	Description
Algorithm	alg	string	The algorithm for the key.
Exponent	e	string	The exponent for the standard pem.
Key ID	kid	string	The unique identifier for the key.
Key Type	kty	string	The key type (https://datatracker.ietf.org/doc/html/rfc7518)
Modulus	n	string	The modulus for a standard pem.
Use	use	string	How the key is meant to be used (i.e. 'sig' represents signature)

protocol.CredentialAssertion_publicKey

Name	Path	Type	Description
Challenge	challenge	string	The challenge.
RP ID	rpId	string	The RP identifier.
Timeout	timeout	integer	The timeout.
User Verification	userVerification	string	This member describes the relying party's requirements regarding user verification for the create() operation. Eligible authenticators are filtered to only those capable of satisfying this requirement.

CredentialCreation_publicKey_authenticatorSelection

Name	Path	Type	Description
Authenticator Attachment	authenticatorAttachment	string	If this member is present, eligible authenticators are filtered to only authenticators attached with the specified AuthenticatorAttachment enum.
Require Resident Key	requireResidentKey	boolean	This member describes the relying party's requirements regarding resident credentials. If the parameter is set to true, the authenticator MUST create a client-side-resident public key credential source when creating a public key credential.
Resident Key	residentKey	string	This member describes the relying party's requirements regarding resident credentials per Webauthn Level 2.
User Verification	userVerification	string	This member describes the relying party's requirements regarding user verification for the create() operation. Eligible authenticators are filtered to only those capable of satisfying this requirement.

CredentialCreation_publicKey_excludeCredentials

Name	Path	Type	Description
ID	id	string	The ID of a credential to allow/disallow.
Transports	transports	array of string	The authenticator transports that can be used.
Type	type	string	The valid credential types.

CredentialCreation_publicKey_pubKeyCredParams

Name	Path	Type	Description
Algorithm	alg	integer	The algorithm.
Type	type	string	The type.

CredentialCreation_publicKey_rp

Name	Path	Type	Description
Icon	icon	string	A serialized URL which resolves to an image associated with the entity. For example, this could be a user's avatar or a relying party's logo. This URL MUST be an a priori authenticated URL. Authenticators MUST accept and store a 128-byte minimum length for an icon member's value. Authenticators MAY ignore an icon member's value if its length is greater than 128 bytes. The URL's scheme MAY be "data" to avoid fetches of the URL, at the cost of needing more storage. Deprecated: this has been removed from the specification recommendations.
ID	id	string	A unique identifier for the relying party entity, which sets the RP ID.
Name	name	string	A human-palatable name for the entity. Its function depends on what the PublicKeyCredentialEntity represents: When inherited by PublicKeyCredentialRpEntity it is a human-palatable identifier for the relying party, intended only for display. For example, "ACME Corporation", "Wonderful Widgets, Inc." or "ОАО Примертех". When inherited by PublicKeyCredentialUserEntity, it is a human-palatable identifier for a user account. It is intended only for display, i.e., aiding the user in determining the difference between user accounts with similar displayNames. For example, "alexm", "alex.p.mueller@example.com" or "+14255551234".

CredentialCreation_publicKey_user

Name	Path	Type	Description
Display Name	displayName	string	A human-palatable name for the user account, intended only for display. The relying party SHOULD let the user choose this, and SHOULD NOT restrict the choice more than necessary.
Icon	icon	string	A serialized URL which resolves to an image associated with the entity. For example, this could be a user's avatar or a relying party's logo. This URL MUST be an a priori authenticated URL. Authenticators MUST accept and store a 128-byte minimum length for an icon member's value. Authenticators MAY ignore an icon member's value if its length is greater than 128 bytes. The URL's scheme MAY be "data" to avoid fetches of the URL, at the cost of needing more storage. Deprecated: this has been removed from the specification recommendations.
ID	id	object	The user handle of the user account entity. To ensure secure operation, authentication and authorization decisions MUST be made on the basis of this id member, not the displayName nor name members. See Section 6.1 of RFC8266.
Name	name	string	A human-palatable name for the entity. Its function depends on what the PublicKeyCredentialEntity represents: When inherited by PublicKeyCredentialRpEntity it is a human-palatable identifier for the relying party, intended only for display. For example, "ACME Corporation", "Wonderful Widgets, Inc." or "ОАО Примертех". When inherited by PublicKeyCredentialUserEntity, it is a human-palatable identifier for a user account. It is intended only for display, i.e., aiding the user in determining the difference between user accounts with similar displayNames. For example, "alexm", "alex.p.mueller@example.com" or "+14255551234".

CredentialCreation_publicKey

Name	Path	Type	Description
Attestation	attestation	string	The attestation.
authenticatorSelection	authenticatorSelection	CredentialCreation_publicKey_authenticatorSelection
Challenge	challenge	string	The challege.
Excluded Credentials	excludeCredentials	array of CredentialCreation_publicKey_excludeCredentials
Public Key Cred Params	pubKeyCredParams	array of CredentialCreation_publicKey_pubKeyCredParams
rp	rp	CredentialCreation_publicKey_rp
Timeout	timeout	integer	The timeout.
user	user	CredentialCreation_publicKey_user