Download OpenAPI specification:Download
Part of the REST API v2 Reference.
Operations about Identity and Access Management.
POST /projects/{project_id}/apps/{app_id}/authenticateGET /projects/{project_id}/iam/authentication_methodsPOST /projects/{project_id}/iam/authentication_methodsDELETE /projects/{project_id}/iam/authentication_methods/{authentication_method_id}GET /projects/{project_id}/iam/authentication_methods/{authentication_method_id}POST /projects/{project_id}/iam/authentication_methods/{authentication_method_id}GET /projects/{project_id}/iam/settingsPOST /projects/{project_id}/iam/settingsIssues a short-lived RevenueCat access token for the given app_user_id, scoped to the app. The token authenticates the subscriber and is not backed by an IAM user; no id token or refresh token is returned. This endpoint requires the following permission(s): iam:authorization:issue_token. This endpoint belongs to the Iam domain, which has a default rate limit of 60 requests per minute.
| project_id required | string <= 255 characters Example: proj1ab2c3d4 ID of the project |
| app_id required | string <= 255 characters Example: app1ab2c3d4 ID of the app |
| app_user_id required | string [ 1 .. 1500 ] characters The app user ID of the subscriber to authenticate. |
{- "app_user_id": "19b8de26-77c1-49f1-aa18-019a391603e2"
}{- "object": "authentication",
- "access_token": "eyJhbGciOiJSUzI1NiIsImtpZCI6InNrXzEyMyJ9.eyJzdWIiOiJhcHBfdXNlcl8xMjMifQ.signature",
- "expires_at": 1658399423658
}This endpoint requires the following permission(s): iam:authentication_methods:read. This endpoint belongs to the Iam domain, which has a default rate limit of 60 requests per minute.
| project_id required | string <= 255 characters Example: proj1ab2c3d4 ID of the project |
| starting_after | string Example: starting_after=ent12354 Pagination cursor. Pass the id of the last item from the previous page to fetch the next page; omit for the first page. |
| limit | integer Default: 20 Example: limit=10 Maximum number of items to return per page. Values below 1 or above 100 are clamped to that range rather than rejected. |
{- "object": "list",
- "items": [
- {
- "object": "iam_authentication_method",
- "id": "b5b7bfd2-66fb-4091-af50-7c3cdccfdf24",
- "name": "Sign in with Google",
- "created_at": 1658399423658,
- "updated_at": 1658399423658,
- "type": "email_otp",
- "sender_name": "My App",
- "reply_to_email": "support@example.com",
- "code_expiration_minutes": 10
}
], - "next_page": "/v2/projects/proj1ab2c3d4/iam/authentication_methods?starting_after=b5b7bfd2-66fb-4091-af50-7c3cdccfdf24",
- "url": "/v2/projects/proj1ab2c3d4/iam/authentication_methods"
}This endpoint requires the following permission(s): iam:authentication_methods:read_write. This endpoint belongs to the Iam domain, which has a default rate limit of 60 requests per minute.
| project_id required | string <= 255 characters Example: proj1ab2c3d4 ID of the project |
| name required | string [ 1 .. 100 ] characters The display name of the authentication method. |
| type required | string The type of the authentication method. |
| sender_name | string or null [ 1 .. 100 ] characters Display name of the sender of the emails. |
| reply_to_email | string or null <email> Reply-to address of the emails. |
| code_expiration_minutes | integer or null [ 1 .. 1440 ] Number of minutes the code stays valid. |
{- "name": "Google",
- "type": "google",
- "client_id": "1234567890-abc.apps.googleusercontent.com"
}{- "object": "iam_authentication_method",
- "id": "b5b7bfd2-66fb-4091-af50-7c3cdccfdf24",
- "name": "Sign in with Google",
- "created_at": 1658399423658,
- "updated_at": 1658399423658,
- "type": "email_otp",
- "sender_name": "My App",
- "reply_to_email": "support@example.com",
- "code_expiration_minutes": 10
}Deletes the authentication method. A method that a published web funnel uses cannot be deleted. This endpoint requires the following permission(s): iam:authentication_methods:read_write. This endpoint belongs to the Iam domain, which has a default rate limit of 60 requests per minute.
| project_id required | string <= 255 characters Example: proj1ab2c3d4 ID of the project |
| authentication_method_id required | string <uuid> Example: b5b7bfd2-66fb-4091-af50-7c3cdccfdf24 ID of the IAM authentication method |
{- "object": "app",
- "id": "string",
- "deleted_at": 1658399423658
}This endpoint requires the following permission(s): iam:authentication_methods:read. This endpoint belongs to the Iam domain, which has a default rate limit of 60 requests per minute.
| project_id required | string <= 255 characters Example: proj1ab2c3d4 ID of the project |
| authentication_method_id required | string <uuid> Example: b5b7bfd2-66fb-4091-af50-7c3cdccfdf24 ID of the IAM authentication method |
{- "object": "iam_authentication_method",
- "id": "b5b7bfd2-66fb-4091-af50-7c3cdccfdf24",
- "name": "Sign in with Google",
- "created_at": 1658399423658,
- "updated_at": 1658399423658,
- "type": "email_otp",
- "sender_name": "My App",
- "reply_to_email": "support@example.com",
- "code_expiration_minutes": 10
}Updates the name and the settings of the authentication method. Only the fields of the type of the method are accepted. The type cannot be changed. This endpoint requires the following permission(s): iam:authentication_methods:read_write. This endpoint belongs to the Iam domain, which has a default rate limit of 60 requests per minute.
| project_id required | string <= 255 characters Example: proj1ab2c3d4 ID of the project |
| authentication_method_id required | string <uuid> Example: b5b7bfd2-66fb-4091-af50-7c3cdccfdf24 ID of the IAM authentication method |
| name | string [ 1 .. 100 ] characters The display name of the authentication method. | ||
| sender_name | string or null [ 1 .. 100 ] characters Display name of the sender of the emails. | ||
| reply_to_email | string or null <email> Reply-to address of the emails. | ||
| code_expiration_minutes | integer or null [ 1 .. 1440 ] Number of minutes the code stays valid. | ||
| magic_link_expiration_minutes | integer or null [ 1 .. 10080 ] Number of minutes the link stays valid. | ||
| issuer_url | string [ 1 .. 2000 ] characters Issuer URL of the identity provider. The OpenID configuration is discovered from it. | ||
| client_id | string or null <= 2000 characters OAuth client id ( | ||
| client_secret | string or null <= 2000 characters Client secret used for interactive login. It is never returned. | ||
| requested_scopes | Array of strings or null[ items non-empty ] OAuth scopes requested from the identity provider in addition to | ||
| app_user_id_claim | string or null Dot-path selector of the ID token claim used as the app user id. When null, the | ||
object or null Static query parameters added to the authorize URL of the identity provider during interactive login. OAuth and PKCE parameters cannot be overridden. | |||
| |||
| id_token_iat_freshness_seconds | integer or null [ 1 .. 60 ] Maximum age in seconds of the | ||
| app_ids | Array of strings or null[ items [ 1 .. 255 ] characters ] Ids of the Apple apps that form the Apple App ID group of the method. Omit or set to null to cover every Apple app of the project. | ||
| primary_app_id | string or null [ 1 .. 255 ] characters Id of the Apple app whose App ID is the primary one in the Apple Developer account. | ||
| facebook_app_id | string [ 1 .. 2000 ] characters Meta app id, matched against the token audience. | ||
| app_secret | string or null [ 1 .. 2000 ] characters Meta app secret, used to verify Android access tokens. It is never returned. | ||
| firebase_project_id | string [ 1 .. 500 ] characters Firebase project id, matched against the | ||
| api_key | string [ 1 .. 2000 ] characters Firebase web API key. | ||
| auth_domain | string [ 1 .. 2000 ] characters Firebase auth domain. | ||
{- "name": "Sign in with Google"
}{- "object": "iam_authentication_method",
- "id": "b5b7bfd2-66fb-4091-af50-7c3cdccfdf24",
- "name": "Sign in with Google",
- "created_at": 1658399423658,
- "updated_at": 1658399423658,
- "type": "email_otp",
- "sender_name": "My App",
- "reply_to_email": "support@example.com",
- "code_expiration_minutes": 10
}This endpoint requires the following permission(s): iam:settings:read. This endpoint belongs to the Iam domain, which has a default rate limit of 60 requests per minute.
| project_id required | string <= 255 characters Example: proj1ab2c3d4 ID of the project |
{- "object": "iam_settings",
- "migration_mode": "protected",
- "effective_migration_mode": "protected"
}This endpoint requires the following permission(s): iam:settings:read_write. This endpoint belongs to the Iam domain, which has a default rate limit of 60 requests per minute.
| project_id required | string <= 255 characters Example: proj1ab2c3d4 ID of the project |
| migration_mode required | string Enum: "dual" "protected" "authenticat_only" The migration mode of the project. |
{- "migration_mode": "protected"
}{- "object": "iam_settings",
- "migration_mode": "protected",
- "effective_migration_mode": "protected"
}All API v2 resources, one page each. General concepts (authentication, pagination, rate limits, error handling) live on the API v2 overview.