> ## Documentation Index
> Fetch the complete documentation index at: https://docs.man0.space/llms.txt
> Use this file to discover all available pages before exploring further.

# Authenticate your app

> Passkey, email and OAuth flows, API tokens and consent.

Read `GET /api/config` before rendering sign-in options. Successful sign-in returns `{ token, user, expires }`; send the Man0 token as `Authorization: Bearer <token>` on account requests.

## Passkeys

Request `/api/auth/passkey/options` with `{ "mode": "create" }` or `{ "mode": "login" }`. Keep the returned challenge `id` and pass `options` to SimpleWebAuthn’s browser helper.

```js theme={null}
const { id, options } = await request('/auth/passkey/options', {
  mode: 'login'
});
const credential = await startAuthentication({ optionsJSON: options });
const auth = await request('/auth/passkey/verify', { id, credential });
```

Here `request` is your JSON POST helper under `https://api.man0.space/api`. Registration uses `startRegistration` and `/auth/passkey/register`. The browser sends its configured origin; use the origin/RP allowed by the backend.

## Email and OAuth

For email, POST `{ email }` to `/api/auth/email/start`, then POST the returned `id` and six-digit `code` to `/api/auth/email/verify`.

For OAuth, open `/api/oauth/{provider}/start?origin=<your-origin>&mode=auth` in a popup. The callback sends an `oauth` message with `ok` and the authentication payload. Check the message origin and close the popup after consuming the result.

`mode=link` uses the profile-linking flow. Telegram is a linking provider. The same OAuth operations also have `/api/auth/oauth` and `/oauth` aliases.

## Policy acceptance

`GET /api/policy` returns the current `hash`, sections and checks. After the user reviews them, POST `{ policy: hash, terms: true, privacy: true }` to `/api/consent` with the Man0 token.

Protected account reads use that token. Workflow writes, media generation and NEAR execution require current consent as well. `DELETE /api/auth` revokes the authentication session; payment authorization uses a separate [Compose spending key](https://docs.man0.space/developer/payments.md).


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.