canonical: https://jentic.com/apis/6-dot-authentiqio.appspot.com/authentiq # 6 Dot Authentiqio Appspot Authentiq API The Authentiq API is the issuer service for the Authentiq passwordless identity platform. It exposes fourteen operations across three resources - keys, login, and scope - that let applications register Authentiq IDs as signing keys, request that a user authenticate against a scope, and complete the resulting login challenge. The protocol uses signed JSON Web Tokens rather than shared passwords, and the API is hosted at the Authentiq issuer endpoint as documented in the public AuthentiqID specification on GitHub. ## For AI agents Register Authentiq signing keys, issue scoped login challenges, and confirm passwordless authentications for applications using the Authentiq identity protocol. ## Scope Does not handle OAuth, OpenID Connect, SAML, or password-based authentication - use for the Authentiq signed-JWT passwordless protocol only. ## Capabilities - Register a new Authentiq ID as a signing key for an application - Look up, update, or revoke an existing Authentiq key by its public key fingerprint - Issue a passwordless login challenge bound to a scope of identity claims - Retrieve and update the status of an outstanding login or scope job - Cancel an in-flight scope job before the user completes authentication ## Use cases ### Passwordless Login for Web Applications Web applications integrate Authentiq as a passwordless login provider so users authenticate by approving a signed challenge on a mobile device instead of typing a password. The /scope and /scope/{job} endpoints handle the challenge lifecycle, while /key endpoints register and look up the user's Authentiq ID. A typical integration replaces a password reset flow and shipping it takes two to three days. Example prompt: Call POST /scope to request the 'email,name' scope, then poll GET /scope/{job} until the user approves on their phone, and validate the returned signed token against the registered key. ### Key Management for Issuer-Backed Identities Applications that distribute signed identities use the /key endpoints to register, rotate, and revoke Authentiq IDs as the canonical signing keys for end users. This replaces ad-hoc public-key directories and gives the application a single API for trust management. Initial setup is typically half a day for the registration flow and a day for revocation handling. Example prompt: Call POST /key to register a new Authentiq ID, store the returned fingerprint, and later call DELETE /key/{PK} to revoke it when the user offboards. ### Step-Up Authentication with Scope Jobs Applications that need extra confirmation for high-value actions issue a scoped challenge through Authentiq before allowing the action to proceed. The /scope endpoints accept the requested claims and return a job ID; the application polls /scope/{job} until the user signs the challenge or the job times out. Typical integration is two days, including the polling and signature verification. Example prompt: Call POST /scope with claim 'transaction_signature' and the transaction details, poll GET /scope/{job} for completion, then accept the signed result before executing the transaction. ### AI Agent Identity Operations via Jentic Agents connected through Jentic can issue Authentiq login challenges and check their status programmatically when verifying the human owner of an account. Jentic returns the matching scope or key operation by intent, so the agent does not need to read the AuthentiqID specification on GitHub. End-to-end an agent can request and verify a challenge in under a minute. Example prompt: Search Jentic for 'request a passwordless login challenge', load /scope, and execute it for the user, then load /scope/{job} to confirm the response. ## Key endpoints | Method | Path | Description | | --- | --- | --- | | POST | /key | Register a new Authentiq ID as a signing key | | GET | /key/{PK} | Look up a key by its public key fingerprint | | DELETE | /key/{PK} | Revoke a registered Authentiq key | | POST | /login | Complete a passwordless login challenge | | POST | /scope | Issue a new scope job requesting identity claims | | GET | /scope/{job} | Retrieve the status of an outstanding scope job | | DELETE | /scope/{job} | Cancel a pending scope job | ## Key resources - **Keys** — Authentiq IDs registered as signing keys with create, fetch, update, and revoke operations - **Login** — Login challenge endpoint for completing a passwordless authentication - **Scope** — Scope-bound challenge jobs for requesting specific identity claims ## Why Jentic - **Setup:** Wiring the Authentiq API by hand means constructing signed JWTs for its passwordless protocol and shaping key, login, and scope payloads yourself, since it uses no shared API key. Through Jentic you install once, import the Authentiq API from the API Directory, store the signing key material once, and your agent calls it. - **Permission scoping:** Authentiq puts the key and scope-job id in the URL path (/key/{PK}, /scope/{job}), so a rule can pin your agent to reading one key or scope job. You choose the operations it may call, so key or scope deletion is not included unless you add it. - **Credential handling:** Your Authentiq signing key material is stored once, encrypted, by your own Jentic One instance and injected at execution time. It never enters the agent's prompt, logs, or context. - **Discovery method:** Agents search Jentic by intent such as 'request a passwordless login challenge' or 'register an Authentiq key', and Jentic returns the matching Authentiq operation with its input schema so the agent calls the right endpoint without browsing the reference docs. ## Related APIs - **Auth0 Management API** — Hosted identity platform with passwordless and full OAuth/OIDC support - **Okta API** — Enterprise identity provider with SSO, MFA, and lifecycle management - **OneLogin API** — Identity platform with SSO and authentication factors - **Hunter Email Verification API** — Verifies email addresses commonly collected during sign-up ## FAQ ### What authentication does the Authentiq API use? The API itself is unauthenticated for the public issuer endpoints - security is provided by signed JSON Web Tokens included in request bodies. Each Authentiq ID is a public-key identity that signs requests, so trust is established by verifying the signature against a registered key rather than by an API key or bearer token. ### Can I use the Authentiq API for passwordless login? Yes. Call POST /scope to issue a challenge requesting the claims you need, then poll GET /scope/{job} until the user approves on their Authentiq mobile app. The completed job returns a signed token containing the requested claims that your application can verify against the user's registered key. ### What are the rate limits for the Authentiq API? Authentiq's public issuer documentation does not publish a numeric rate limit. Treat the issuer as fair-use, cache the result of GET /key/{PK} responses, and back off on HTTP 429 or 5xx responses. Avoid tight polling loops on /scope/{job}; use a one-to-three-second poll interval per outstanding job. ### How do I register a signing key with the Authentiq API through Jentic? After running pip install jentic and setting JENTIC_AGENT_API_KEY, search Jentic for 'register an Authentiq signing key', load POST /key, and execute it with the user's Authentiq ID. The response includes the public key fingerprint to store against the user record. ### Does the Authentiq API issue tokens itself or just verify them? It does both within its own protocol. POST /scope and POST /login produce signed responses that the calling application can verify, while POST /key registers the public side of a key pair so subsequent verifications resolve correctly. The API does not issue OAuth or OpenID Connect tokens - it implements the Authentiq passwordless protocol. ### Where can I get more details about the Authentiq protocol? The protocol is documented in the AuthentiqID GitHub repository, including the issuer specification this OpenAPI definition is derived from. The repository describes the JWT-based challenge format and the mobile app interaction model in detail. ### Can I limit what my agent is allowed to do with the Authentiq API? Yes. Because you run Jentic One yourself, your own rules decide which Authentiq operations the agent may call, so you can allow it to issue and check scope jobs (POST /scope, GET /scope/{job}) while leaving destructive calls like DELETE /key/{PK} or DELETE /scope/{job} out of its reach. Since Authentiq puts the key and job id in the URL path (/key/{PK}, /scope/{job}), a rule can also pin the agent to reading a single key or a single scope job rather than any it wants. Your signing key material stays with your own instance and is injected only at execution time, so the agent never handles the credentials directly.