Accounts and sessions
Console client configuration · Response and shared models
Sign-in endpoints issue tenant sessions. Use accessToken for management calls and refreshToken for refresh and logout. After auth.refresh, call setAccessToken with the new access token and persist the returned refresh token in your service. The SDK does not refresh sessions automatically.
OAuth authorization returns authorizeUrl and state. Open the URL in your frontend and send the callback code, state, and original redirectUri to your backend. A WeChat callback with nextAction=bind_phone requires phone verification using bindTicket. Your application handles browser windows, redirects, and session storage.
auth.methods returns providers and captcha configuration for the request host. When captcha.enabled=true, include the captcha component’s captchaTicket and captchaRandstr in SMS requests.
auth.methods
Available sign-in methods.
GET /v1/auth/methods
Authentication: public endpoint.
| Language | Call |
|---|---|
| Node.js | c.auth.methods() |
| Python | c.auth.methods() |
| Java | c.auth.methods() |
| Go | c.Auth.Methods(ctx, &result) |
| PHP | $c->auth->methods() |
No request fields.
Returns: AuthMethods. See shared models for nested fields.
auth.sendSms
Send SMS code.
POST /v1/auth/sms/send
Authentication: public endpoint.
| Language | Call |
|---|---|
| Node.js | c.auth.sendSms(input) |
| Python | c.auth.send_sms(**input) |
| Java | c.auth.sendSms(input) |
| Go | c.Auth.SendSms(ctx, input, &result) |
| PHP | $c->auth->sendSms($input) |
Input: SmsSendInput. Fields are sent in the JSON body.
| Field | Required | Type | Description |
|---|---|---|---|
phone | Yes | string | Mainland China phone number, optionally prefixed with +86 |
scene | No | "login" | "bind" | undefined | OTP scene; console sign-in uses login |
captchaTicket | No | string | undefined | Captcha ticket |
captchaRandstr | No | string | undefined | Captcha random string |
Returns: SendCodeResult. See shared models for nested fields.
auth.verifySms
Sign in with SMS.
POST /v1/auth/sms/verify
Authentication: public endpoint.
| Language | Call |
|---|---|
| Node.js | c.auth.verifySms(input) |
| Python | c.auth.verify_sms(**input) |
| Java | c.auth.verifySms(input) |
| Go | c.Auth.VerifySms(ctx, input, &result) |
| PHP | $c->auth->verifySms($input) |
Input: SmsVerifyInput. Fields are sent in the JSON body.
| Field | Required | Type | Description |
|---|---|---|---|
code | Yes | string | Verification or OAuth authorization code |
phone | Yes | string | Mainland China phone number, optionally prefixed with +86 |
scene | No | "login" | "bind" | undefined | OTP scene; console sign-in uses login |
captchaTicket | No | string | undefined | Captcha ticket |
captchaRandstr | No | string | undefined | Captcha random string |
Returns: AuthSession. See shared models for nested fields.
auth.sendEmail
Send email code.
POST /v1/auth/email/send
Authentication: public endpoint.
| Language | Call |
|---|---|
| Node.js | c.auth.sendEmail(input) |
| Python | c.auth.send_email(**input) |
| Java | c.auth.sendEmail(input) |
| Go | c.Auth.SendEmail(ctx, input, &result) |
| PHP | $c->auth->sendEmail($input) |
Input: EmailSendInput. Fields are sent in the JSON body.
| Field | Required | Type | Description |
|---|---|---|---|
email | Yes | string | Email address |
scene | No | "login" | "bind" | undefined | OTP scene; console sign-in uses login |
Returns: SendCodeResult. See shared models for nested fields.
auth.verifyEmail
Sign in with email.
POST /v1/auth/email/verify
Authentication: public endpoint.
| Language | Call |
|---|---|
| Node.js | c.auth.verifyEmail(input) |
| Python | c.auth.verify_email(**input) |
| Java | c.auth.verifyEmail(input) |
| Go | c.Auth.VerifyEmail(ctx, input, &result) |
| PHP | $c->auth->verifyEmail($input) |
Input: EmailVerifyInput. Fields are sent in the JSON body.
| Field | Required | Type | Description |
|---|---|---|---|
code | Yes | string | Verification or OAuth authorization code |
email | Yes | string | Email address |
scene | No | "login" | "bind" | undefined | OTP scene; console sign-in uses login |
Returns: AuthSession. See shared models for nested fields.
auth.googleAuthorize
Google authorization URL.
GET /v1/auth/google/authorize
Authentication: public endpoint.
| Language | Call |
|---|---|
| Node.js | c.auth.googleAuthorize(input) |
| Python | c.auth.google_authorize(**input) |
| Java | c.auth.googleAuthorize(input) |
| Go | c.Auth.GoogleAuthorize(ctx, input, &result) |
| PHP | $c->auth->googleAuthorize($input) |
Input: OAuthAuthorizeInput. Fields are sent as URL query parameters.
| Field | Required | Type | Description |
|---|---|---|---|
redirectUri | Yes | string | OAuth callback URL; use the same value for authorization and exchange |
state | No | string | undefined | OAuth state value |
Returns: GoogleAuthorizeResult. See shared models for nested fields.
auth.googleCallback
Exchange Google authorization code.
POST /v1/auth/google/callback
Authentication: public endpoint.
| Language | Call |
|---|---|
| Node.js | c.auth.googleCallback(input) |
| Python | c.auth.google_callback(**input) |
| Java | c.auth.googleCallback(input) |
| Go | c.Auth.GoogleCallback(ctx, input, &result) |
| PHP | $c->auth->googleCallback($input) |
Input: GoogleCallbackPayload. Fields are sent in the JSON body.
| Field | Required | Type | Description |
|---|---|---|---|
code | Yes | string | Verification or OAuth authorization code |
state | Yes | string | OAuth state value |
redirectUri | Yes | string | OAuth callback URL; use the same value for authorization and exchange |
Returns: AuthSession. See shared models for nested fields.
auth.googleToken
Sign in with Google ID token.
POST /v1/auth/google/token
Authentication: public endpoint.
| Language | Call |
|---|---|
| Node.js | c.auth.googleToken(input) |
| Python | c.auth.google_token(**input) |
| Java | c.auth.googleToken(input) |
| Go | c.Auth.GoogleToken(ctx, input, &result) |
| PHP | $c->auth->googleToken($input) |
Input: GoogleTokenInput. Fields are sent in the JSON body.
| Field | Required | Type | Description |
|---|---|---|---|
idToken | Yes | string | ID token from Google Identity Services |
Returns: AuthSession. See shared models for nested fields.
auth.wechatAuthorize
WeChat authorization URL.
GET /v1/auth/wechat/authorize
Authentication: public endpoint.
| Language | Call |
|---|---|
| Node.js | c.auth.wechatAuthorize(input) |
| Python | c.auth.wechat_authorize(**input) |
| Java | c.auth.wechatAuthorize(input) |
| Go | c.Auth.WechatAuthorize(ctx, input, &result) |
| PHP | $c->auth->wechatAuthorize($input) |
Input: OAuthAuthorizeInput. Fields are sent as URL query parameters.
| Field | Required | Type | Description |
|---|---|---|---|
redirectUri | Yes | string | OAuth callback URL; use the same value for authorization and exchange |
state | No | string | undefined | OAuth state value |
Returns: GoogleAuthorizeResult. See shared models for nested fields.
auth.wechatCallback
Exchange WeChat authorization code.
POST /v1/auth/wechat/callback
Authentication: public endpoint.
| Language | Call |
|---|---|
| Node.js | c.auth.wechatCallback(input) |
| Python | c.auth.wechat_callback(**input) |
| Java | c.auth.wechatCallback(input) |
| Go | c.Auth.WechatCallback(ctx, input, &result) |
| PHP | $c->auth->wechatCallback($input) |
Input: GoogleCallbackPayload. Fields are sent in the JSON body.
| Field | Required | Type | Description |
|---|---|---|---|
code | Yes | string | Verification or OAuth authorization code |
state | Yes | string | OAuth state value |
redirectUri | Yes | string | OAuth callback URL; use the same value for authorization and exchange |
Returns: WechatCallbackResult. See shared models for nested fields.
auth.sendWechatBindPhone
Send phone code for WeChat sign-in.
POST /v1/auth/wechat/bind-phone/send
Authentication: public endpoint.
| Language | Call |
|---|---|
| Node.js | c.auth.sendWechatBindPhone(input) |
| Python | c.auth.send_wechat_bind_phone(**input) |
| Java | c.auth.sendWechatBindPhone(input) |
| Go | c.Auth.SendWechatBindPhone(ctx, input, &result) |
| PHP | $c->auth->sendWechatBindPhone($input) |
Input: WechatBindPhoneSendInput. Fields are sent in the JSON body.
| Field | Required | Type | Description |
|---|---|---|---|
bindTicket | Yes | string | One-time binding ticket from the WeChat callback |
phone | Yes | string | Mainland China phone number, optionally prefixed with +86 |
captchaTicket | No | string | undefined | Captcha ticket |
captchaRandstr | No | string | undefined | Captcha random string |
Returns: SendCodeResult. See shared models for nested fields.
auth.verifyWechatBindPhone
Verify phone for WeChat sign-in.
POST /v1/auth/wechat/bind-phone/verify
Authentication: public endpoint.
| Language | Call |
|---|---|
| Node.js | c.auth.verifyWechatBindPhone(input) |
| Python | c.auth.verify_wechat_bind_phone(**input) |
| Java | c.auth.verifyWechatBindPhone(input) |
| Go | c.Auth.VerifyWechatBindPhone(ctx, input, &result) |
| PHP | $c->auth->verifyWechatBindPhone($input) |
Input: WechatBindPhoneVerifyInput. Fields are sent in the JSON body.
| Field | Required | Type | Description |
|---|---|---|---|
code | Yes | string | Verification or OAuth authorization code |
bindTicket | Yes | string | One-time binding ticket from the WeChat callback |
phone | Yes | string | Mainland China phone number, optionally prefixed with +86 |
captchaTicket | No | string | undefined | Captcha ticket |
captchaRandstr | No | string | undefined | Captcha random string |
Returns: AuthSession. See shared models for nested fields.
auth.sendBindPhone
Send phone binding code.
POST /v1/auth/phone/bind/send
Authentication: tenant Bearer token.
| Language | Call |
|---|---|
| Node.js | c.auth.sendBindPhone(input) |
| Python | c.auth.send_bind_phone(**input) |
| Java | c.auth.sendBindPhone(input) |
| Go | c.Auth.SendBindPhone(ctx, input, &result) |
| PHP | $c->auth->sendBindPhone($input) |
Input: BindPhoneSendInput. Fields are sent in the JSON body.
| Field | Required | Type | Description |
|---|---|---|---|
phone | Yes | string | Mainland China phone number, optionally prefixed with +86 |
captchaTicket | No | string | undefined | Captcha ticket |
captchaRandstr | No | string | undefined | Captcha random string |
Returns: SendCodeResult. See shared models for nested fields.
auth.verifyBindPhone
Bind phone to signed-in account.
POST /v1/auth/phone/bind/verify
Authentication: tenant Bearer token.
| Language | Call |
|---|---|
| Node.js | c.auth.verifyBindPhone(input) |
| Python | c.auth.verify_bind_phone(**input) |
| Java | c.auth.verifyBindPhone(input) |
| Go | c.Auth.VerifyBindPhone(ctx, input, &result) |
| PHP | $c->auth->verifyBindPhone($input) |
Input: PhoneVerifyInput. Fields are sent in the JSON body.
| Field | Required | Type | Description |
|---|---|---|---|
phone | Yes | string | Mainland China phone number, optionally prefixed with +86 |
code | Yes | string | Verification or OAuth authorization code |
captchaTicket | No | string | undefined | Captcha ticket |
captchaRandstr | No | string | undefined | Captcha random string |
Returns: AuthUser. See shared models for nested fields.
auth.wechatBindAuthorize
WeChat account binding URL.
GET /v1/auth/wechat/bind/authorize
Authentication: tenant Bearer token.
| Language | Call |
|---|---|
| Node.js | c.auth.wechatBindAuthorize(input) |
| Python | c.auth.wechat_bind_authorize(**input) |
| Java | c.auth.wechatBindAuthorize(input) |
| Go | c.Auth.WechatBindAuthorize(ctx, input, &result) |
| PHP | $c->auth->wechatBindAuthorize($input) |
Input: OAuthAuthorizeInput. Fields are sent as URL query parameters.
| Field | Required | Type | Description |
|---|---|---|---|
redirectUri | Yes | string | OAuth callback URL; use the same value for authorization and exchange |
state | No | string | undefined | OAuth state value |
Returns: GoogleAuthorizeResult. See shared models for nested fields.
auth.wechatBindCallback
Bind WeChat to account.
POST /v1/auth/wechat/bind/callback
Authentication: tenant Bearer token.
| Language | Call |
|---|---|
| Node.js | c.auth.wechatBindCallback(input) |
| Python | c.auth.wechat_bind_callback(**input) |
| Java | c.auth.wechatBindCallback(input) |
| Go | c.Auth.WechatBindCallback(ctx, input, &result) |
| PHP | $c->auth->wechatBindCallback($input) |
Input: GoogleCallbackPayload. Fields are sent in the JSON body.
| Field | Required | Type | Description |
|---|---|---|---|
code | Yes | string | Verification or OAuth authorization code |
state | Yes | string | OAuth state value |
redirectUri | Yes | string | OAuth callback URL; use the same value for authorization and exchange |
Returns: AuthUser. See shared models for nested fields.
auth.refresh
Refresh tenant session.
POST /v1/auth/token/refresh
Authentication: public endpoint.
| Language | Call |
|---|---|
| Node.js | c.auth.refresh(input) |
| Python | c.auth.refresh(**input) |
| Java | c.auth.refresh(input) |
| Go | c.Auth.Refresh(ctx, input, &result) |
| PHP | $c->auth->refresh($input) |
Input: RefreshInput. Fields are sent in the JSON body.
| Field | Required | Type | Description |
|---|---|---|---|
refreshToken | Yes | string | Tenant refresh token |
Returns: AuthSession. See shared models for nested fields.
auth.logout
Revoke tenant session.
POST /v1/auth/logout
Authentication: public endpoint.
| Language | Call |
|---|---|
| Node.js | c.auth.logout(input) |
| Python | c.auth.logout(**input) |
| Java | c.auth.logout(input) |
| Go | c.Auth.Logout(ctx, input, &result) |
| PHP | $c->auth->logout($input) |
Input: RefreshInput. Fields are sent in the JSON body.
| Field | Required | Type | Description |
|---|---|---|---|
refreshToken | Yes | string | Tenant refresh token |
Returns: LogoutResult. See shared models for nested fields.
auth.me
Current account.
GET /v1/auth/me
Authentication: tenant Bearer token.
| Language | Call |
|---|---|
| Node.js | c.auth.me() |
| Python | c.auth.me() |
| Java | c.auth.me() |
| Go | c.Auth.Me(ctx, &result) |
| PHP | $c->auth->me() |
No request fields.
Returns: CurrentUserResult. See shared models for nested fields.