Authentication
Sign-in, magic links, TOTP and password reset. The five unauthenticated routes are throttled per address and per IP.
Sign in with email and password
On success this sets the session cookie. **The token is not in the body** —
End the session
Both halves happen. The session is recorded as disabled, so it is dead even if
Email a single-use sign-in link
Answers `202` **unconditionally** — registered address or not, suspended
Redeem a sign-in link
The token from the e-mail becomes a session, and sets the same cookie sign-in
Who is signed in
The sign-in body minus `expires_in`: the operator, and the casinos they hold
Set which casino this operator lands on
A preference on the account, not a claim in the session: the active casino
Email a password reset code
Answers `202` unconditionally, for the same anti-enumeration reason the
Set a new password with a reset code
Answers `204` and **no session**. Handing out a cookie here would make an
Extend the session
Reissues the cookie from the current session's claims and answers the new
Turn two-factor off
Removes the second factor and burns every recovery code with it.
Turn two-factor on
Confirms the enrolment with a code from the authenticator, and answers with
Begin TOTP enrolment
Returns the shared secret and its `otpauth://` URI — a QR code's worth of
Replace the recovery codes
Invalidates the previous set and answers with a new one. Shown once, like the