canonical: https://jentic.com/apis/mojoauth.com/mojoauth

# MojoAuth API

Jentic publishes the only available OpenAPI specification for MojoAuth API, keeping it validated and agent-ready. MojoAuth is a passwordless authentication platform that issues and verifies one-time passwords across email, phone, and WhatsApp, alongside magic links and passkey-based WebAuthn flows. The API consolidates these methods behind a single set of send and verify endpoints, plus token refresh and verify operations for managing authenticated sessions. It targets product teams replacing password-based logins with OTP or biometric alternatives in days rather than weeks.

## For AI agents

Send and verify passwordless authentication challenges via email OTP, SMS OTP, WhatsApp OTP, magic links, and passkeys, with session token refresh and verification.

## Scope

Does not handle role-based authorization, enterprise SSO, or user profile storage - use for passwordless OTP and passkey authentication only.

## Capabilities

- Send email OTP codes and verify user-submitted codes against MojoAuth
- Trigger SMS or WhatsApp OTP delivery for phone-based passwordless login
- Issue magic link emails and verify the link token on callback
- Register and authenticate users with WebAuthn passkeys
- Verify and refresh MojoAuth-issued JWT session tokens

## Use cases

### Passwordless Login for Web and Mobile Apps

Replace password-based authentication with email or SMS OTP using MojoAuth's send-and-verify endpoint pairs. The API handles code generation, delivery, expiration, and verification, so product teams ship a working passwordless flow in a single sprint instead of building OTP infrastructure from scratch. Suitable for B2C apps where reducing password reset friction directly improves activation.

Example prompt: Call POST `/users/emailotp` with the user's email, then call POST `/users/emailotp/verify` with the code they entered to issue a session JWT.

### WhatsApp OTP for High-Deliverability Verification

Send one-time passcodes over WhatsApp instead of SMS for markets where WhatsApp is the dominant messaging channel and SMS deliverability is poor. MojoAuth's WhatsApp OTP endpoints let teams add the channel without negotiating directly with WhatsApp Business API providers. Useful for apps targeting LATAM, India, and parts of EMEA where WhatsApp adoption exceeds SMS reliability.

Example prompt: Call POST `/users/whatsapp` with a phone number, then POST `/users/whatsapp/verify` with the user-submitted code.

### Passkey and WebAuthn Onboarding

Add passkey registration and login to an existing app using MojoAuth's WebAuthn endpoints, which abstract the FIDO2 server-side ceremony. Once a user has a passkey, subsequent logins are phishing-resistant and faster than OTP. Recommended for apps with returning users where reducing login friction has measurable retention impact.

Example prompt: Call POST `/users/passkey/register` to create a passkey for a user, then POST `/users/passkey/login` on subsequent visits to authenticate them.

### Agent-Driven User Verification Flows

AI agents managing customer support or onboarding workflows trigger MojoAuth OTP challenges to verify a user's identity before performing sensitive actions. Through Jentic, the agent calls the appropriate send endpoint, waits for the user's code, and calls the verify endpoint - all without holding the MojoAuth API key in its context. Jentic's spec is the only structured definition for this API.

Example prompt: Search Jentic for 'send otp to verify a user', load POST `/users/emailotp`, execute it with the user's email, then verify the returned code.

## Key endpoints

| Method | Path | Description |
| --- | --- | --- |
| POST | `/users/emailotp` | Send an email OTP to a user |
| POST | `/users/emailotp/verify` | Verify an email OTP code |
| POST | `/users/phone` | Send an SMS OTP to a phone number |
| POST | `/users/phone/verify` | Verify an SMS OTP code |
| POST | `/users/whatsapp` | Send a WhatsApp OTP |
| POST | `/users/passkey/register` | Register a WebAuthn passkey |
| POST | `/users/passkey/login` | Authenticate with an existing passkey |
| POST | `/token/refresh` | Refresh a MojoAuth session token |

## Key resources

- **Email OTP** — Send and verify one-time codes via email
- **Phone OTP** — Send and verify SMS OTP codes for phone-based login
- **WhatsApp OTP** — Deliver and verify one-time codes via WhatsApp
- **Magic Link** — Send and verify single-use magic link tokens for email-based login
- **Passkey** — Register and authenticate users with WebAuthn passkeys
- **Token** — Verify and refresh MojoAuth-issued session tokens

## Why Jentic

- **Setup:** Wiring the MojoAuth API by hand means setting the X-API-Key header, pairing each send call with its verify call, and coding the OTP and passkey flows yourself. Through Jentic you install once, import the MojoAuth API from the API Directory, store the key once, and your agent calls it.
- **Permission scoping:** MojoAuth carries the login target in the request body rather than as a path resource, so you limit the agent to the operations it needs, such as sending an email OTP and verifying it. You choose the operations it may call, so passkey registration or token refresh is not included unless you add it.
- **Credential handling:** Your MojoAuth API key is stored once, encrypted, by your own Jentic One instance and injected at execution time. It never enters the agent's prompt, logs, or context.
- **Discovery method:** Agents search Jentic by intent such as 'send a passwordless login code', and Jentic returns the matching MojoAuth send and verify operations with their parameter schema so the agent calls the right endpoint without browsing the reference docs.

## Related APIs

- **Auth0 Authentication API** — Full-featured identity platform covering passwordless, social login, MFA, and enterprise SSO
- **Stytch API** — Passwordless and passkey authentication platform with similar OTP, magic link, and WebAuthn coverage
- **Clerk Backend API** — Full user management platform with hosted UI components for sign-up, sign-in, and account settings

## FAQ

### Why is there no official OpenAPI spec for MojoAuth API?

MojoAuth does not publish an OpenAPI specification. Jentic generates and maintains this spec so that AI agents and developers can call MojoAuth API via structured tooling. It is validated against the live API and kept up to date. Get started with Jentic One, the self-hosted execution layer.

### What authentication does the MojoAuth API use?

MojoAuth uses an API key passed in the X-API-Key request header. Through Jentic, the API key is held encrypted in the credential vault and injected at execution time, so the secret never enters the agent's prompt or response context.

### Can I add WhatsApp OTP login with the MojoAuth API?

Yes. Call POST `/users/whatsapp` with the user's phone number to trigger the WhatsApp OTP, then POST `/users/whatsapp/verify` with the code the user submitted to complete the login. The same send-and-verify pattern is mirrored across email and SMS endpoints.

### What are the rate limits for the MojoAuth API?

MojoAuth does not document rate limits in this OpenAPI spec. Production usage should reference https://mojoauth.com for current limits - typically OTP send endpoints are rate-limited per phone number or email to prevent abuse, while verify endpoints are limited per challenge.

### How do I issue a passwordless email login through Jentic?

Run pip install jentic, search for 'send a passwordless email login code', load POST `/users/emailotp`, and execute with the user's email. When the user submits the code, call POST `/users/emailotp/verify` through Jentic to receive the session JWT.

### Does MojoAuth handle passkeys?

Yes. POST `/users/passkey/register` starts the WebAuthn registration ceremony for a new passkey, and POST `/users/passkey/login` authenticates a returning user with their existing passkey. MojoAuth handles the FIDO2 server logic so the client only needs the browser WebAuthn API.

### Can I limit what my agent is allowed to do with the MojoAuth API?

Yes. Because you self-host Jentic One, your own rules decide which MojoAuth operations and credentials the agent may use. Since MojoAuth carries the login target in the request body rather than as a path resource, you can allow only the operations the agent needs, such as POST `/users/emailotp` to send an email OTP and POST `/users/emailotp/verify` to check it. Passkey registration and token refresh stay off limits unless you explicitly add them.