import{r,p as h,q as c,w as t,z as e,t as o,R as s}from"./vendor.8ed37afc.js";const d={class:"markdown-body"},u={class:"two-up"},p={class:"left"},_=s("All data within the platform is private by default. The "),g=s("public role"),f=s(" can be configured to expose data without authentication, or you can pass an access token to the API to access private data."),v=e("div",{class:"right"},[e("p",null,[e("div",{class:"table-of-contents"},[e("ul",null,[e("li",null,[e("a",{href:"#access-tokens"},"Access Tokens")]),e("li",null,[e("a",{href:"#login"},"Login")]),e("li",null,[e("a",{href:"#refresh"},"Refresh")]),e("li",null,[e("a",{href:"#logout"},"Logout")]),e("li",null,[e("a",{href:"#request-password-reset"},"Request Password Reset")]),e("li",null,[e("a",{href:"#reset-a-password"},"Reset a Password")]),e("li",null,[e("a",{href:"#list-auth-providers"},"List Auth Providers")]),e("li",null,[e("a",{href:"#login-using-sso-providers"},"Login Using SSO Providers")])])])])],-1),m=e("hr",null,null,-1),k=e("h2",{id:"access-tokens"},[s("Access Tokens "),e("a",{class:"header-anchor",href:"#access-tokens"},"#")],-1),b=e("div",{class:"two-up"},[e("div",{class:"left"},[e("p",null,"There are two types of tokens that can be used to authenticate within Directus."),e("p",null,[e("strong",null,"Temporary Token (JWT)"),s(" are returned by the "),e("a",{href:"#login"},"login"),s(" endpoint/mutation. These tokens have a relatively short expiration time, and are thus the most secure option to use. The tokens are returned with a "),e("code",null,"refresh_token"),s(" that can be used to retrieve a new access token via the "),e("a",{href:"#refresh"},"refresh"),s(" endpoint/mutation.")]),e("p",null,[e("strong",null,"Static Tokens"),s(" can be set for each platform user, and never expire. They are less secure, but quite useful for server-to-server communication. They are saved as plain-text within "),e("code",null,"directus_users.token"),s(".")]),e("p",null,[s("Once you have your access token, there are two ways to pass it to the API, via the "),e("code",null,"access_token"),s(" query parameter, or in the request\u2019s Authorization Header.")])]),e("div",{class:"right"},[e("h3",{id:"query-parameter"},[s("Query Parameter "),e("a",{class:"header-anchor",href:"#query-parameter"},"#")]),e("pre",null,[e("code",null,`?access_token=<token>
`)]),e("h3",{id:"authorization-header"},[s("Authorization Header "),e("a",{class:"header-anchor",href:"#authorization-header"},"#")]),e("pre",null,[e("code",null,`Authorization: Bearer <token>
`)])])],-1),w=e("hr",null,null,-1),q=e("h2",{id:"login"},[s("Login "),e("a",{class:"header-anchor",href:"#login"},"#")],-1),y=e("p",null,"Retrieve a temporary access token and refresh token.",-1),j={class:"two-up"},T={class:"left"},P=e("h3",{id:"request-body"},[s("Request Body "),e("a",{class:"header-anchor",href:"#request-body"},"#")],-1),R=e("div",{class:"definitions"},[e("p",null,[e("code",null,"email"),s(),e("strong",null,"Required"),e("br"),s(" Email address of the user you\u2019re retrieving the access token for.")]),e("p",null,[e("code",null,"password"),s(),e("strong",null,"Required"),e("br"),s(" Password of the user.")]),e("p",null,[e("code",null,"otp"),e("br"),s(" The user\u2019s one-time-password (if MFA is enabled).")]),e("p",null,[e("code",null,"mode"),e("br"),s(" Whether to retrieve the refresh token in the JSON response, or in a "),e("code",null,"httpOnly"),s(),e("code",null,"secure"),s(" cookie. One of "),e("code",null,"json"),s(", "),e("code",null,"cookie"),s(". Defaults to "),e("code",null,"json"),s(".")])],-1),S=e("h3",{id:"response-attributes"},[s("Response Attributes "),e("a",{class:"header-anchor",href:"#response-attributes"},"#")],-1),O=e("div",{class:"definitions"},[e("p",null,[e("code",null,"access_token"),s(),e("strong",null,"string"),e("br"),s(" Temporary access token to be used in follow-up requests.")]),e("p",null,[e("code",null,"expires"),s(),e("strong",null,"integer"),e("br"),s(" How long before the access token will expire. Value is in milliseconds.")]),e("p",null,[e("code",null,"refresh_token"),s(),e("strong",null,"string"),e("br"),s(" The token that can be used to retrieve a new access token through "),e("a",{href:"#refresh"},[e("code",null,"/auth/refresh")]),s(". Note: if you used "),e("code",null,"cookie"),s(" as the mode in the request, the refresh token won\u2019t be returned in the JSON.")])],-1),A={class:"tip hint"},x=e("div",{class:"hint-title"},"Expiry time",-1),L=s("The token\u2019s expiration time can be configured through "),E=s("the "),B=e("code",null,"ACCESS_TOKEN_TTL",-1),N=s(" environment variable"),I=s("."),G=e("div",{class:"right"},[e("h3",{id:"rest-api"},[s("REST API "),e("a",{class:"header-anchor",href:"#rest-api"},"#")]),e("pre",null,[e("code",null,`POST /auth/login
`)]),e("pre",null,[e("code",null,`POST /auth/login/:provider
`)]),e("pre",null,[e("code",{class:"language-json"},[s(`{
	`),e("span",{class:"hljs-attr"},'"email"'),s(": "),e("span",{class:"hljs-string"},'"admin@example.com"'),s(`,
	`),e("span",{class:"hljs-attr"},'"password"'),s(": "),e("span",{class:"hljs-string"},'"d1r3ct5us"'),s(`
}
`)])]),e("h3",{id:"graphql"},[s("GraphQL "),e("a",{class:"header-anchor",href:"#graphql"},"#")]),e("pre",null,[e("code",null,`POST /graphql/system
`)]),e("pre",null,[e("code",{class:"language-graphql"},[e("span",{class:"hljs-keyword"},"mutation"),s(` {
	auth_login(email: `),e("span",{class:"hljs-string"},'"admin@example.com"'),s(", password: "),e("span",{class:"hljs-string"},'"d1r3ctu5"'),s(`) {
		access_token
		refresh_token
	}
}
`)])])],-1),W=e("hr",null,null,-1),D=e("h2",{id:"refresh"},[s("Refresh "),e("a",{class:"header-anchor",href:"#refresh"},"#")],-1),C=e("p",null,"Retrieve a new access token using a refresh token.",-1),J=e("div",{class:"two-up"},[e("div",{class:"left"},[e("h3",{id:"request-body-2"},[s("Request Body "),e("a",{class:"header-anchor",href:"#request-body-2"},"#")]),e("div",{class:"definitions"},[e("p",null,[e("code",null,"refresh_token"),e("br"),s(" The refresh token to use. If you have the refresh token in a cookie through "),e("a",{href:"#login"},[e("code",null,"/auth/login")]),s(", you don\u2019t have to submit it here.")]),e("p",null,[e("code",null,"mode"),e("br"),s(" Whether to retrieve the refresh token in the JSON response, or in a "),e("code",null,"httpOnly"),s(),e("code",null,"secure"),s(" cookie. One of "),e("code",null,"json"),s(", "),e("code",null,"cookie"),s(". Defaults to "),e("code",null,"json"),s(".")])]),e("h3",{id:"response-attributes-2"},[s("Response Attributes "),e("a",{class:"header-anchor",href:"#response-attributes-2"},"#")]),e("div",{class:"definitions"},[e("p",null,[e("code",null,"access_token"),s(),e("strong",null,"string"),e("br"),s(" Temporary access token to be used in follow-up requests.")]),e("p",null,[e("code",null,"expires"),s(),e("strong",null,"integer"),e("br"),s(" How long before the access token will expire. Value is in milliseconds.")]),e("p",null,[e("code",null,"refresh_token"),s(),e("strong",null,"string"),e("br"),s(" The token that can be used to retrieve a new access token through "),e("a",{href:"#refresh"},[e("code",null,"/auth/refresh")]),s(". Note: if you used "),e("code",null,"cookie"),s(" as the mode in the request, the refresh token won\u2019t be returned in the JSON.")])])]),e("div",{class:"right"},[e("h3",{id:"rest-api-2"},[s("REST API "),e("a",{class:"header-anchor",href:"#rest-api-2"},"#")]),e("pre",null,[e("code",null,`POST /auth/refresh
`)]),e("pre",null,[e("code",{class:"language-json"},[s(`{
	`),e("span",{class:"hljs-attr"},'"refresh_token"'),s(": "),e("span",{class:"hljs-string"},'"gmPd...8wuB"'),s(`
}
`)])]),e("h3",{id:"graphql-2"},[s("GraphQL "),e("a",{class:"header-anchor",href:"#graphql-2"},"#")]),e("pre",null,[e("code",null,`POST /graphql/system
`)]),e("pre",null,[e("code",{class:"language-graphql"},[e("span",{class:"hljs-keyword"},"mutation"),s(` {
	auth_refresh(refresh_token: `),e("span",{class:"hljs-string"},'"abc...def"'),s(", mode: "),e("span",{class:"hljs-string"},'"json"'),s(`) {
		access_token
		refresh_token
	}
}
`)])])])],-1),z=e("hr",null,null,-1),Q=e("h2",{id:"logout"},[s("Logout "),e("a",{class:"header-anchor",href:"#logout"},"#")],-1),H=e("p",null,"Invalidate the refresh token thus destroying the user\u2019s session.",-1),U=e("div",{class:"two-up"},[e("div",{class:"left"},[e("h3",{id:"request-body-3"},[s("Request Body "),e("a",{class:"header-anchor",href:"#request-body-3"},"#")]),e("div",{class:"definitions"},[e("p",null,[e("code",null,"refresh_token"),e("br"),s(" The refresh token to invalidate. If you have the refresh token in a cookie through "),e("a",{href:"#login"},[e("code",null,"/auth/login")]),s(", you don\u2019t have to submit it here.")])])]),e("div",{class:"right"},[e("h3",{id:"rest-api-3"},[s("REST API "),e("a",{class:"header-anchor",href:"#rest-api-3"},"#")]),e("pre",null,[e("code",null,`POST /auth/logout
`)]),e("pre",null,[e("code",{class:"language-json"},[s(`{
	`),e("span",{class:"hljs-attr"},'"refresh_token"'),s(": "),e("span",{class:"hljs-string"},'"gmPd...8wuB"'),s(`
}
`)])]),e("h3",{id:"graphql-3"},[s("GraphQL "),e("a",{class:"header-anchor",href:"#graphql-3"},"#")]),e("pre",null,[e("code",null,`POST /graphql/system
`)]),e("pre",null,[e("code",{class:"language-graphql"},[e("span",{class:"hljs-keyword"},"mutation"),s(` {
	auth_logout(refresh_token: `),e("span",{class:"hljs-string"},'"gmPd...8wuB"'),s(`)
}
`)])])])],-1),V=e("hr",null,null,-1),K=e("h2",{id:"request-password-reset"},[s("Request Password Reset "),e("a",{class:"header-anchor",href:"#request-password-reset"},"#")],-1),F=e("p",null,"Request a password reset email to be sent to the given user.",-1),M={class:"two-up"},Y={class:"left"},X=e("h3",{id:"request-body-4"},[s("Request Body "),e("a",{class:"header-anchor",href:"#request-body-4"},"#")],-1),Z={class:"definitions"},$=e("p",null,[e("code",null,"email"),s(),e("strong",null,"Required"),e("br"),s(" Email address of the user you\u2019re requesting a password reset for.")],-1),ee=e("code",null,"reset_url",-1),se=e("br",null,null,-1),te=s(" Provide a custom reset url which the link in the email will lead to. The reset token will be passed as a parameter."),ne=e("br",null,null,-1),oe=e("strong",null,"Note",-1),le=s(": You need to configure the "),re=e("code",null,"PASSWORD_RESET_URL_ALLOW_LIST",-1),ae=s(" environment variable"),ie=s(" to enable this feature."),he=e("div",{class:"right"},[e("h3",{id:"rest-api-4"},[s("REST API "),e("a",{class:"header-anchor",href:"#rest-api-4"},"#")]),e("pre",null,[e("code",null,`POST /auth/password/request
`)]),e("pre",null,[e("code",{class:"language-json"},[s(`{
	`),e("span",{class:"hljs-attr"},'"email"'),s(": "),e("span",{class:"hljs-string"},'"admin@example.com"'),s(`
}
`)])]),e("h3",{id:"graphql-4"},[s("GraphQL "),e("a",{class:"header-anchor",href:"#graphql-4"},"#")]),e("pre",null,[e("code",null,`POST /graphql/system
`)]),e("pre",null,[e("code",{class:"language-graphql"},[e("span",{class:"hljs-keyword"},"mutation"),s(` {
	auth_password_request(email: `),e("span",{class:"hljs-string"},'"admin@example.com"'),s(`)
}
`)])])],-1),ce=e("hr",null,null,-1),de=e("h2",{id:"reset-a-password"},[s("Reset a Password "),e("a",{class:"header-anchor",href:"#reset-a-password"},"#")],-1),ue=e("p",null,"The request a password reset endpoint sends an email with a link to the admin app (or a custom route) which in turn uses this endpoint to allow the user to reset their password.",-1),pe=e("div",{class:"two-up"},[e("div",{class:"left"},[e("h3",{id:"request-body-5"},[s("Request Body "),e("a",{class:"header-anchor",href:"#request-body-5"},"#")]),e("div",{class:"definitions"},[e("p",null,[e("code",null,"token"),s(),e("strong",null,"Required"),e("br"),s(" Password reset token, as provided in the email sent by the request endpoint.")]),e("p",null,[e("code",null,"password"),s(),e("strong",null,"Required"),e("br"),s(" New password for the user.")])])]),e("div",{class:"right"},[e("h3",{id:"rest-api-5"},[s("REST API "),e("a",{class:"header-anchor",href:"#rest-api-5"},"#")]),e("pre",null,[e("code",null,`POST /auth/password/reset
`)]),e("pre",null,[e("code",{class:"language-json"},[s(`{
	`),e("span",{class:"hljs-attr"},'"token"'),s(": "),e("span",{class:"hljs-string"},'"eyJh...KmUk"'),s(`,
	`),e("span",{class:"hljs-attr"},'"password"'),s(": "),e("span",{class:"hljs-string"},'"d1r3ctu5"'),s(`
}
`)])]),e("h3",{id:"graphql-5"},[s("GraphQL "),e("a",{class:"header-anchor",href:"#graphql-5"},"#")]),e("pre",null,[e("code",null,`POST /graphql/system
`)]),e("pre",null,[e("code",{class:"language-graphql"},[e("span",{class:"hljs-keyword"},"mutation"),s(` {
	auth_password_reset(token: `),e("span",{class:"hljs-string"},'"eyJh...KmUk"'),s(", password: "),e("span",{class:"hljs-string"},'"d1r3ctu5"'),s(`)
}
`)])])])],-1),_e=e("hr",null,null,-1),ge=e("h2",{id:"list-auth-providers"},[s("List Auth Providers "),e("a",{class:"header-anchor",href:"#list-auth-providers"},"#")],-1),fe=e("p",null,"List all the configured auth providers.",-1),ve={class:"two-up"},me={class:"left"},ke={class:"tip hint"},be=e("div",{class:"hint-title"},"Configuring auth providers",-1),we=s("To learn more about setting up auth providers, see "),qe=s("Configuring auth providers"),ye=s("."),je=e("h3",{id:"response-attributes-3"},[s("Response Attributes "),e("a",{class:"header-anchor",href:"#response-attributes-3"},"#")],-1),Te=e("div",{class:"definitions"},[e("p",null,[e("code",null,"data"),s(),e("strong",null,"Array"),e("br"),s(" Array of configured auth providers.")]),e("p",null,[e("code",null,"disableDefault"),s(),e("strong",null,"boolean"),e("br"),s(" Whether or not the default authentication provider is disabled.")])],-1),Pe=e("div",{class:"right"},[e("pre",null,[e("code",null,`GET /auth
`)]),e("pre",null,[e("code",{class:"language-json"},[s(`{
	`),e("span",{class:"hljs-attr"},'"data"'),s(`: [
		{
			`),e("span",{class:"hljs-attr"},'"name"'),s(": "),e("span",{class:"hljs-string"},'"GitHub"'),s(`,
			`),e("span",{class:"hljs-attr"},'"driver"'),s(": "),e("span",{class:"hljs-string"},'"oauth2"'),s(`,
			`),e("span",{class:"hljs-attr"},'"icon"'),s(": "),e("span",{class:"hljs-string"},'"github"'),s(`
		},
		{
			`),e("span",{class:"hljs-attr"},'"name"'),s(": "),e("span",{class:"hljs-string"},'"Google"'),s(`,
			`),e("span",{class:"hljs-attr"},'"driver"'),s(": "),e("span",{class:"hljs-string"},'"openid"'),s(`,
			`),e("span",{class:"hljs-attr"},'"icon"'),s(": "),e("span",{class:"hljs-string"},'"google"'),s(`
		},
		{
			`),e("span",{class:"hljs-attr"},'"name"'),s(": "),e("span",{class:"hljs-string"},'"Okta"'),s(`,
			`),e("span",{class:"hljs-attr"},'"driver"'),s(": "),e("span",{class:"hljs-string"},'"openid"'),s(`
		}
	],
	`),e("span",{class:"hljs-attr"},'"disableDefault"'),s(": "),e("span",{class:"hljs-literal"},"false"),s(`
}
`)])])],-1),Re=e("hr",null,null,-1),Se=e("h2",{id:"login-using-sso-providers"},[s("Login Using SSO Providers "),e("a",{class:"header-anchor",href:"#login-using-sso-providers"},"#")],-1),Oe=e("p",null,"Will redirect to the configured SSO provider for the user to login.",-1),Ae=e("div",{class:"two-up"},[e("div",{class:"right"},[e("pre",null,[e("code",null,`GET /auth/login/:provider
`)])])],-1),xe=e("hr",null,null,-1),Ie={setup(Le,{expose:a}){const l={title:"Authentication",modularExtension:!1,pageClass:"page-reference"};return a({frontmatter:l}),(Ee,Be)=>{const n=r("router-link"),i=r("DocsWrapper");return h(),c(i,{frontmatter:l},{default:t(()=>[e("div",d,[e("div",u,[e("div",p,[e("blockquote",null,[e("p",null,[_,o(n,{to:"/docs/configuration/users-roles-permissions/#configuring-public-permissions"},{default:t(()=>[g]),_:1}),f])])]),v]),m,k,b,w,q,y,e("div",j,[e("div",T,[P,R,S,O,e("div",A,[x,e("p",null,[L,o(n,{to:"/docs/configuration/config-options/#general"},{default:t(()=>[E,B,N]),_:1}),I])])]),G]),W,D,C,J,z,Q,H,U,V,K,F,e("div",M,[e("div",Y,[X,e("div",Z,[$,e("p",null,[ee,se,te,ne,oe,le,o(n,{to:"/docs/configuration/config-options/#security"},{default:t(()=>[re,ae]),_:1}),ie])])]),he]),ce,de,ue,pe,_e,ge,fe,e("div",ve,[e("div",me,[e("div",ke,[be,e("p",null,[we,o(n,{to:"/docs/configuration/config-options/#authentication"},{default:t(()=>[qe]),_:1}),ye])]),je,Te]),Pe]),Re,Se,Oe,Ae,xe])]),_:1})}}};export{Ie as default};
