Authentication
sfp server API reference for Authentication: 4 endpoints.
/sfp/api/auth/callbackValidates the provided access token and optional refresh token
Request Body
application/json
TypeScript Definitions
Use the request body type in TypeScript.
Response Body
application/json
curl -X POST "https://example.com/sfp/api/auth/callback" \ -H "Content-Type: application/json" \ -d '{ "access_token": "eyJhbGciOiJIUzI1NilsImtpZCI6IlRbEty..." }'{ "success": true, "data": { "userId": "123" }}/sfp/api/auth/resolve-emailsValidates the access token (without membership lookup) and uses the GitHub provider token to fetch all verified emails and store them as aliases for user matching. This endpoint is public to avoid a bootstrap deadlock where a user with a mismatched email cannot authenticate to reach this endpoint.
Request Body
application/json
TypeScript Definitions
Use the request body type in TypeScript.
Response Body
application/json
curl -X POST "https://example.com/sfp/api/auth/resolve-emails" \ -H "Content-Type: application/json" \ -d '{ "access_token": "string", "provider_token": "gho_xxxxxxxxxxxx" }'{ "aliases": [ "user@company.com", "user@personal.com" ]}/sfp/api/auth/admin/loginAuthenticates an admin user with email and password credentials
Request Body
application/json
TypeScript Definitions
Use the request body type in TypeScript.
Response Body
application/json
curl -X POST "https://example.com/sfp/api/auth/admin/login" \ -H "Content-Type: application/json" \ -d '{ "email": "admin@example.com", "password": "password123" }'{ "success": true, "access_token": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...", "refresh_token": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...", "local_supabase_url": "https://tenant.example.com", "local_supabase_anon_key": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...", "aal": "aal2", "user": { "id": "123", "email": "admin@example.com", "role": "owner" }, "error": "Invalid credentials"}/sfp/api/auth/continueBack-compat 302 for old PR links. Resolves the legacy targetOrg to its review-env assignment and redirects to /review-env/:assignmentId.
Query Parameters
Legacy action; only 'frontDoorUrl' is supported.
Legacy comma-separated key:value blob, e.g. targetOrg:myorg,repository:org/repo
Response Body
curl -X GET "https://example.com/sfp/api/auth/continue?action=string¶ms=string"