HonkIOHonkIO Auth
Auth API reference
Manage sign-in apps, their security, plans, organizations and users from your back end, under /v1/auth-apps.
Base URL and keys
Every route is under https://api.honkio.ca/v1/auth-apps and authenticates with an API key, like the rest of the HonkIO API. A test key sees and manages test apps; a live key, live apps.
Permissions
Three permissions cover HonkIO Auth, with the usual letters: r for GET, w for POST, m for PATCH and PUT, d for DELETE (API keys). Existing keys don’t gain them.
| Permission | Covers |
|---|---|
| auth_apps | Apps, domains, branding, sign-in methods, security settings and blocklists, plans, costs and usage, and the sign-in policy |
| auth_users | Users, sessions, sign-in history and exports |
| auth_organizations | Organizations, memberships, roles and invitations |
Conventions
JSON in and out. Lists return data and next_cursor; pass it back as cursor for the next page (Pagination). An app that isn’t yours, isn’t in your key’s mode, or was deleted answers 404 NOT_FOUND. Errors have the usual shape; the codes specific to HonkIO Auth are under Errors. Responses that carry a client secret are sent with Cache-Control: no-store.
Resources
The routes, by resource:
- Apps
Create sign-in apps, change their settings and branding, verify their domains, rotate secrets, and delete them.
10 routes
- Security
Abuse settings, attack mode, per-app blocklists and the security summary.
6 routes
- Plan and usage
Read and change an app’s plan, cancel a scheduled downgrade, and read its sign-in costs by method and its user count.
5 routes
- Organizations
The sign-in policy, organizations, memberships, roles and invitations.
19 routes
- Users
Users, their sessions and sign-in history, blocking and deleting, and exports.
17 routes