canonical: https://jentic.com/apis/cloud.google.com/google-identity-toolkit

# Google Identity Toolkit API

Jentic publishes the only available OpenAPI specification for Google Identity Toolkit API, keeping it validated and agent-ready. Identity Toolkit is Google's relying-party authentication API that helps third-party sites implement federated login, account management, and email-based verification. The 20 endpoints cover signup and password verification, federated assertion verification, account info management, project configuration, public keys, OOB confirmation codes for email verification, and phone number verification. It is the underlying API surface that Firebase Authentication is built on top of.

## For AI agents

Implement federated and password-based login, manage user accounts, and verify email and phone numbers using Google Identity Toolkit's relying-party endpoints.

## Scope

Does not handle workforce SSO, fine-grained authorisation, or directory provisioning - use for relying-party authentication and account management only.

## Capabilities

- Sign new users up with email and password via /signupNewUser and verify passwords via /verifyPassword
- Verify a federated identity provider assertion via /verifyAssertion and custom tokens via /verifyCustomToken
- Send email link sign-in messages via /emailLinkSignin
- Issue out-of-band confirmation codes for email verification or password reset via /getOobConfirmationCode
- Read and update user account info via /getAccountInfo and /setAccountInfo
- Send and verify phone-number verification codes via /sendVerificationCode and /verifyPhoneNumber
- Bulk import or export accounts via /uploadAccount and /downloadAccount

## Use cases

### Federated Login for a Web or Mobile App

Let users sign in to a third-party site with Google, Facebook, or other identity providers by passing their assertion to /verifyAssertion, which validates the IdP token and returns an Identity Toolkit ID token plus account info. The /createAuthUri endpoint helps the front end determine which providers a given email is linked to.

Example prompt: Call /createAuthUri with the user's email to get linked providers, then on assertion return call /verifyAssertion to issue the ID token.

### Email and Password Account Lifecycle

Run a self-serve signup, login, password reset, and email verification flow on a third-party site using /signupNewUser, /verifyPassword, /getOobConfirmationCode, and /resetPassword. The /emailLinkSignin endpoint supports passwordless email-link login as an alternative to passwords.

Example prompt: Sign a new user up via /signupNewUser, send a verification OOB code via /getOobConfirmationCode, then on email-link click verify via /emailLinkSignin.

### Phone Number Verification

Verify a user's phone number by sending a one-time code via /sendVerificationCode and validating the code via /verifyPhoneNumber. The result is a phone-credential ID token that can be combined with a federated or password account.

Example prompt: Send a verification code via /sendVerificationCode for a phone number, then on user input validate via /verifyPhoneNumber to issue the phone credential.

### Account Migration and Bulk Operations

Migrate an existing user base into Identity Toolkit using /uploadAccount and export the resulting accounts via /downloadAccount for backup or downstream use. Account records can be inspected and updated in flight via /getAccountInfo and /setAccountInfo.

Example prompt: Use /uploadAccount with the hashed password records from the legacy system, then verify a sample with /verifyPassword to confirm the import.

### AI Agent Identity Operations via Jentic

An AI agent that runs identity operations for a SaaS app can verify users, reset passwords, or send verification codes by searching Jentic for the matching Identity Toolkit operation. Jentic securely stores the OAuth credentials so the agent only ever holds scoped execution rights.

Example prompt: Use the Jentic search query 'verify a user password' to find /verifyPassword and execute with the email and password to obtain an ID token.

## Key endpoints

| Method | Path | Description |
| --- | --- | --- |
| POST | `/signupNewUser` | Sign up a new user with email and password |
| POST | `/verifyPassword` | Verify a user's password and issue an ID token |
| POST | `/verifyAssertion` | Verify a federated identity provider assertion |
| POST | `/verifyPhoneNumber` | Verify a phone number with a one-time code |
| POST | `/sendVerificationCode` | Send a phone verification SMS |
| POST | `/getOobConfirmationCode` | Issue an out-of-band confirmation code |
| POST | `/getAccountInfo` | Read account info for one or more users |
| POST | `/setAccountInfo` | Update account info for a user |

## Key resources

- **Account Management** — Sign up, sign in, sign out, and read or update account info
- **Federated Auth** — Verify identity provider assertions and custom tokens
- **Email Verification** — Issue OOB confirmation codes and email link sign-in
- **Phone Verification** — Send and verify SMS one-time codes
- **Project Config** — Read and write project-level Identity Toolkit configuration
- **Bulk Operations** — Upload and download account records for migration

## Why Jentic

- **Setup:** Wiring Google Identity Toolkit by hand means running the OAuth 2.0 flow, refreshing access tokens, mapping its relying-party account and verification endpoints, and handling retries yourself. Through Jentic you install once, import the Identity Toolkit API from the API Directory, store the OAuth credentials once, and your agent calls it.
- **Permission scoping:** Identity Toolkit's account and verification targets travel in the request body rather than the URL path, so scope the agent to the operations it needs, such as verifying a password or sending a phone verification code. You choose which operations are in that set, so setAccountInfo changes are not included unless you add them.
- **Credential handling:** Your Google OAuth 2.0 credentials are stored once, encrypted, by your own Jentic One instance, which injects a scoped access token at execution time. The client secret and refresh token never enter the agent's prompt, logs, or context.
- **Discovery method:** Agents search Jentic by intent such as 'verify a user password' or 'send a phone verification code', and Jentic returns the matching Identity Toolkit operation with its input schema, so the agent calls the right endpoint without browsing the reference docs.

## Related APIs

- **Auth0** — Hosted identity platform with universal login and rich rules engine
- **Okta** — Enterprise identity platform with workforce and customer identity products
- **Firebase** — Mobile and web app platform that wraps Identity Toolkit auth

## FAQ

### Why is there no official OpenAPI spec for Google Identity Toolkit API?

Google does not publish a structured OpenAPI specification for the public Identity Toolkit relying-party API. Jentic generates and maintains this spec so that AI agents and developers can call Google Identity Toolkit API via structured tooling. It is validated against the live API and kept up to date. Get started with Jentic One, the self-hosted execution layer.

### What authentication does the Google Identity Toolkit API use?

The API uses OAuth 2.0 with Google-issued credentials for the relying-party project. Through Jentic the OAuth credentials are stored encrypted in the vault and the agent only holds a scoped execution context.

### Can I verify a Google or Facebook login token with this API?

Yes. POST the IdP assertion to /verifyAssertion to validate the token and receive an Identity Toolkit ID token along with the linked account info. /createAuthUri can be used first to learn which providers an email is linked to.

### How do I send a phone OTP through Jentic?

Search Jentic for 'send a phone verification code', load the schema for /sendVerificationCode, and execute with the phone number. The Python SDK uses await client.search, await client.load, await client.execute, then verify the user's code via /verifyPhoneNumber.

### How do I trigger a password reset email?

Call /getOobConfirmationCode with the password reset request type and the user's email to send the reset email. When the user follows the link, exchange the OOB code via /resetPassword to set the new credential.

### Is this the same as Firebase Authentication?

Identity Toolkit is the underlying relying-party API that Firebase Authentication is built on. Firebase wraps these endpoints with client SDKs and additional configuration; calling Identity Toolkit directly is appropriate when you want to manage relying-party flows from a backend.

### Can I limit what my agent is allowed to do with the Google Identity Toolkit API?

Yes. Because you run Jentic One yourself, your own rules decide which Identity Toolkit operations and which stored Google OAuth credentials the agent may use. Identity Toolkit sends its account and verification targets in the request body rather than the URL, so you scope the agent to only the operations it needs, such as verifying a password with /verifyPassword or sending a phone code with /sendVerificationCode. Account-changing calls like /setAccountInfo stay out of that set unless you explicitly add them.