canonical: https://jentic.com/apis/n-auth.com/nextauth-main

# N Auth nextAuth API

Jentic publishes the only available OpenAPI specification for nextAuth API, keeping it validated and agent-ready. nextAuth is a phishing-resistant multi-factor authentication platform that uses smartphone-bound cryptographic keys for login, transaction signing, and user enrolment. The 55-endpoint server-management API lets administrators provision servers, manage accounts and roles, run QR-code and HTML enrolment flows, sign transactions, and read session and audit data. This is the management-plane variant of the nextAuth API used by integrators provisioning and operating the service.

## For AI agents

Provision nextAuth servers, enrol users via QR or HTML flows, manage accounts and roles, and sign sensitive transactions with phishing-resistant MFA. Best for security teams adding strong authentication to existing apps.

## Scope

Does not handle SSO federation, password resets, or user directory sync - use for phishing-resistant MFA enrolment, session lifecycle, and transaction signing only.

## Capabilities

- Enrol users into phishing-resistant MFA via QR-code or HTML flows
- Sign high-value transactions cryptographically before they execute
- Provision and configure nextAuth server tenants and their attributes
- Manage accounts, roles, and permissions per server
- Provoke a login from the server side to step up an existing session
- Read active sessions and force logout for incident response

## Use cases

### Phishing-Resistant MFA Enrolment

Add strong, hardware-backed MFA to an existing web or mobile app by enrolling users via QR-code or HTML flow endpoints. The `/servers/{serverid}/sessions/qr/enrol` and `/sessions/html/enrol` endpoints return the artefacts the front end shows the user; once scanned or completed, the user is bound to a smartphone credential immune to credential-phishing replays. Adds compliance-grade MFA in days rather than months versus building a WebAuthn flow from scratch.

Example prompt: Call GET `/servers/{serverid}/sessions/qr/enrol` to fetch a QR payload and present it on the user's signup screen for nextAuth enrolment.

### Cryptographic Transaction Signing

For high-value actions such as wire transfers, configuration changes, or admin elevation, push the operation through nextAuth's transaction-signing flow so the user authorises it on their bound device. POST `/servers/{serverid}/sessions/transactions` creates the signing request and returns a signature the server can verify. Replaces SMS OTP and shared-secret approval steps with a phishing-resistant cryptographic confirmation.

Example prompt: Submit a wire transfer of $25,000 to POST `/servers/{serverid}/sessions/transactions` and only execute it if the returned signature verifies.

### Account and Role Administration

Manage accounts, roles, attributes, and privileged attributes per server tenant for multi-tenant SaaS deployments. The `/servers/{serverid}/accounts` and `/servers/{serverid}/permissions/{roleid}` endpoints support listing, updating, and deleting accounts and role permissions, and the privileged-attribute paths control sensitive metadata that only privileged roles can read. Ideal for B2B platforms that resell nextAuth to their own customers.

Example prompt: List all accounts on server ID 9 via GET `/servers/{serverid}/accounts` and revoke any account that has not logged in for 90 days.

### Incident Response Session Lockdown

When a compromise is suspected, security teams can list active sessions, force logout users, and provoke fresh authentication on next access using the /sessions endpoints. POST `/servers/{serverid}/sessions/logout` invalidates a session, and POST `/servers/{serverid}/sessions/provokelogin` forces a step-up on the next request. Saves coordinating with each downstream app to invalidate cookies during an incident.

Example prompt: On a security alert, call POST `/servers/{serverid}/sessions/logout` for every session belonging to the suspected-compromised account.

### AI Agent Authentication Co-Pilot

Wire nextAuth into an AI agent through Jentic so the agent can enrol users, list sessions, and trigger step-up flows on demand. Through Jentic's intent search the agent picks the right operation from 55 endpoints without reading the spec, and the X-apikey header is held server-side. Lets security teams expose self-service MFA management to a chat agent without leaking admin credentials into the chat surface.

Example prompt: Search Jentic for 'enrol a nextAuth user' and execute the QR enrol endpoint on behalf of a support agent helping a new employee set up MFA.

## Key endpoints

| Method | Path | Description |
| --- | --- | --- |
| GET | `/servers/{serverid}/sessions/qr/enrol` | Generate a QR enrolment payload for binding a new user device |
| GET | `/servers/{serverid}/sessions/html/enrol` | Return an embeddable HTML enrolment flow |
| POST | `/servers/{serverid}/sessions/transactions` | Create a cryptographic transaction-signing request |
| POST | `/servers/{serverid}/sessions/logout` | Force logout of a session |
| POST | `/servers/{serverid}/sessions/provokelogin` | Provoke a step-up login on the next request |
| GET | `/servers/{serverid}/accounts` | List accounts attached to a server tenant |
| GET | `/servers/{serverid}/sessions` | List active sessions on a server |
| GET | `/apikeys` | List API keys provisioned for the management API |

## Key resources

- **Servers** — Provision and configure nextAuth server tenants and their attributes
- **Accounts** — Manage user accounts, including provoke-login and user updates
- **Sessions** — Run QR and HTML enrolment, login, logout, provoke-login, and transaction signing
- **Permissions** — Manage role-based permissions per server tenant
- **Attributes** — Read and write account attributes and privileged attributes
- **API Keys** — Manage API keys used for server-side authentication to the nextAuth API

## Why Jentic

- **Setup:** Wiring nextAuth by hand means holding its X-apikey and X-su headers, setting them on every call against api.nextauth.com, and mapping the enrolment, session, and transaction-signing calls yourself. Through Jentic you install once, import nextAuth from the API Directory, store the credentials once, and your agent calls it.
- **Permission scoping:** nextAuth puts the server id in the URL path (`/servers/{serverid}/sessions`, `/servers/{serverid}/accounts`), so a rule can pin your agent to one server. You choose the operations it may call, so session-ending ones like logout are not included unless you add them.
- **Credential handling:** Your nextAuth X-apikey and X-su values are stored once, encrypted, by your own Jentic One instance and injected at execution time. They never enter the agent's prompt, logs, or context.
- **Discovery method:** Agents search Jentic by intent such as 'enrol a user into nextAuth' or 'sign a transaction', and Jentic returns the matching nextAuth operation with its parameter schema so the agent calls the right endpoint without browsing the reference docs.

## Related APIs

- **Auth0 Management API** — Full-stack identity platform with MFA, SSO, and user management
- **Okta Management API** — Enterprise identity platform with broad MFA and lifecycle management
- **Stytch API** — Modern auth APIs with passwordless, magic links, and biometric login
- **nextAuth API (alternate slug)** — Companion nextauth-api spec covering the same operations under a different slug

## FAQ

### Why is there no official OpenAPI spec for nextAuth API?

n-auth.com does not publish an OpenAPI specification. Jentic generates and maintains this spec so that AI agents and developers can call nextAuth API via structured tooling. It is validated against the live API and kept up to date. Get started with Jentic One, the self-hosted execution layer.

### What authentication does the nextAuth API use?

The nextAuth management API uses an API key in the X-apikey header, plus an X-su header carrying a role ID for privileged operations. Both are defined as apiKey schemes in the spec. Through Jentic, both headers are stored encrypted in the vault and injected at execution time.

### Can I enrol a user into nextAuth MFA with this API?

Yes. Use GET `/servers/{serverid}/sessions/qr/enrol` for QR-code enrolment or GET `/servers/{serverid}/sessions/html/enrol` for an embeddable HTML flow. Both return artefacts the front end presents so the user can bind their smartphone credential.

### How does transaction signing work in nextAuth?

POST `/servers/{serverid}/sessions/transactions` creates a transaction-signing request the user approves on their bound device. The response carries a cryptographic signature the relying server verifies before executing the underlying action, replacing SMS OTP for high-value approvals.

### What rate limits apply to the nextAuth API?

Rate limits are not declared in the spec. Treat the API as moderately rate-limited, implement exponential backoff on HTTP 429, and contact n-auth support for committed throughput before running large account-management or session-listing batches.

### How do I trigger nextAuth enrolment from an AI agent through Jentic?

Install the Jentic SDK with pip install jentic. Use SearchRequest with a query like 'enrol nextAuth user via QR' to surface GET `/servers/{serverid}/sessions/qr/enrol`, LoadRequest for its schema, and ExecutionRequest to call it. Get an agent API key through Jentic One, the self-hosted execution layer.

### Can I limit what my agent is allowed to do with the nextAuth API?

Yes. Because you run Jentic One yourself, your own rules decide which nextAuth operations and credentials the agent may use. Since nextAuth puts the server id in the URL path, such as `/servers/{serverid}/accounts` and `/servers/{serverid}/sessions`, a rule can pin the agent to a single server tenant. You also pick the exact operations it may call, so session-ending calls like POST `/servers/{serverid}/sessions/logout` or transaction signing at POST `/servers/{serverid}/sessions/transactions` are excluded unless you add them.