canonical: https://jentic.com/apis/n-auth.com/nextauth-api

# N Auth nextAuth API

The nextAuth API runs a passwordless authentication server, pushing login confirmations to a user's app and verifying whether a session is logged in. It manages the servers, accounts, users, roles, and attributes behind each deployment, generates login and enrolment QR codes, and creates transactions for a user to approve within a session.

## For AI agents

Push passwordless login confirmations, verify sessions, generate login and enrolment QR codes, and manage the servers, accounts, users, and roles behind a nextAuth deployment.

## Scope

Does not handle billing, email delivery, or hardware token provisioning. Use for passwordless authentication, session, and user management only.

## Capabilities

- Push a passwordless login confirmation to a user's authenticator app
- Check whether a user is logged in for a given server session
- Generate login and enrolment QR code data for a server
- Manage servers, accounts, users, roles, and attributes under a deployment
- Create a transaction for the user to approve within a session

## Use cases

### Passwordless Login Inside an AI Agent

An AI agent triggers a passwordless login by pushing a confirmation to the user's authenticator app and then checking whether the session became logged in. The provokelogin operation sends the push for a given server and account, so an assistant can authenticate a user without handling passwords.

Example prompt: Call the provokelogin operation for the target server and account, then poll the session check operation until the user is logged in.

### Session Verification Before an Action

A workflow confirms a live session before performing a sensitive step. The session check operation reports whether the user is logged in for a server session, giving the agent a gate it can require before continuing.

Example prompt: Call the session check operation for the server and session, and proceed only when it reports the user is logged in.

### Transaction Approval by the User

An agent asks a user to approve a specific action, such as a payment or a settings change, from their authenticator app. The transactions operation creates an approval request within the current session, and the transaction result operation returns the outcome.

Example prompt: Create a transaction with the transactions operation, then read its outcome from the transaction result operation once the user responds.

## Key endpoints

| Method | Path | Description |
| --- | --- | --- |
| POST | `/servers/{serverid}/sessions/provokelogin` | Push a login confirmation to the user's app |
| GET | `/servers/{serverid}/sessions` | Check whether the user is logged in |
| GET | `/servers/{serverid}/sessions/qr/login` | Generate data for a login QR code |
| POST | `/servers/{serverid}/sessions/transactions` | Create a transaction for the user to approve |
| GET | `/servers/{serverid}/users` | List all users on a server |

## Key resources

- **Sessions** — Push login confirmations, check login status, and generate login and enrolment QR codes
- **Servers** — Create and configure the virtual servers a key is scoped to
- **Users and accounts** — Manage users, accounts, roles, and their attributes under a server
- **Transactions** — Create in-session approval requests and read their outcomes

## Why Jentic

- **Setup:** Wiring the nextAuth API by hand means passing the X-apikey header on every call, tracking server, account, and user IDs across its 55 operations, and handling optional role impersonation yourself. Through Jentic you install once, import it from the API Directory, store the key once, and your agent calls it.
- **Permission scoping:** Because operations are addressed by server, account, and user IDs, a rule can pin your agent to one server or to read-only session checks. You choose the operations and resources it may reach, so the rest stay out of scope unless you add them.
- **Credential handling:** Your nextAuth API key is stored once, encrypted, by your own Jentic One instance and injected into the X-apikey header at execution time. It never enters the agent's prompt, logs, or context.
- **Discovery method:** Agents search Jentic by intent such as 'send a login confirmation' or 'check if a user is logged in', and Jentic returns the matching nextAuth operation with its input schema so the agent calls the right endpoint without browsing the reference docs.

## Related APIs

- **Stytch** — Passwordless and multi-factor authentication as a hosted service.
- **Auth0** — Identity platform for login, sessions, and user management.
- **Okta** — Enterprise identity and access management.

## FAQ

### What authentication does the nextAuth API use?

Every operation requires an API key sent in the X-apikey header, scoped to a specific virtual server, per its OpenAPI spec. An optional X-su header lets a key with root or setrid permissions impersonate another role. Through Jentic the key is stored encrypted in your own Jentic One instance and injected at call time.

### Can the nextAuth API confirm whether a user is logged in?

Yes. The session check operation reports whether the user is logged in for a given server session, and the provokelogin operation pushes a login confirmation to the user's app. An agent can gate an action on a live session before proceeding.

### What are the rate limits for the nextAuth API?

The OpenAPI spec does not specify rate limits. Check the nextAuth documentation for current limits before scaling automated login pushes, since they involve a real device notification.

### How do I send a passwordless login with the nextAuth API through Jentic?

Search Jentic for 'send a login confirmation', add the nextAuth API from the directory, and your agent calls the provokelogin operation for the target server and account using your stored X-apikey. To run it on your own infrastructure, install Jentic One from its GitHub repo.

### Is there a nextAuth API MCP server?

You don't need an MCP server to give your agent the nextAuth API. Jentic connects it directly from the API Directory: import it, store your X-apikey once, and your agent calls the login, session, and user operations. Nothing extra loads into the agent's context until a call is made.

### Can I limit what my agent is allowed to do with the nextAuth API?

Yes. Write a rule that allows just the operations and servers you want, such as checking sessions on one server without deleting users, so the agent cannot touch anything else, and every call is logged. Because operations are scoped by server, account, and user IDs, rules can bound the exact resources your agent reaches.