AuthKit

AuthKit API reference

Complete released AuthKit-Lite endpoint reference grouped by authentication, passkeys, users, and operations.

Updated 2026-08-29

Authentication

Authentication endpoints
Method	Path	Access	Purpose
POST	/api/auth/register	Public	Create a user; passwords require at least 12 characters
POST	/api/auth/login	Public	Return JWT access and opaque refresh tokens
POST	/api/auth/refresh	Public	Rotate a valid refresh token and return a new token pair
POST	/api/auth/logout	Bearer JWT	Invalidate the supplied refresh-token session

Users and admin

User endpoints
Method	Path	Access	Purpose
GET	/api/users/me	Bearer JWT	Return the current user profile
GET	/api/users	ROLE_ADMIN	Return a pageable user list
GET	/api/users/me/passkeys	Bearer JWT	List the current user's passkey metadata

Passkeys

WebAuthn endpoints
Method	Path	Access	Purpose
GET	/webauthn/csrf	Public	Create/read the ceremony CSRF token
POST	/webauthn/register/options	Bearer JWT + CSRF	Create registration options
POST	/webauthn/register	Bearer JWT + CSRF	Complete registration with browser attestation
DELETE	/webauthn/register/{credentialId}	Owner + CSRF	Delete an owned credential
POST	/webauthn/authenticate/options	Public + CSRF	Create authentication options
POST	/login/webauthn	Public + CSRF	Complete authentication and return AuthKit tokens

Passkey implementation guide

Operations and testing

Operational endpoints
Method	Path	Access	Purpose
GET	/actuator	Public	Actuator discovery links
GET	/actuator/health	Public	Health information
GET	/actuator/info	Public	Application information
GET	/api-test	Public	Redirect to the browser API console