Authentication & Account

Login (/login) supports both a standard password login and a 2FA login step (/api/login/2fa) where enabled, plus Google OAuth login as an alternative sign-in method.

Single session per user

A pending-session-decision flow (/api/login/session-decision) enforces one active session per user: signing in somewhere new while already logged in elsewhere prompts a decision - take over the new session or cancel – rather than silently running both.

Password reset & account unlock

Reset Password (/reset-password) - OTP-based password reset
Unlock Account (/unlock-account) - an account-unlock request flow for a locked-out user

All three of these top-level auth pages, plus the login screen itself, are public routes that don’t require an existing session.