11.3 Authentication (Better Auth)

ANY /api/v1/auth/{operation}

• Purpose. Catch-all for Better Auth. Methods exported: GET, POST, PATCH, PUT, DELETE.
• Response format. Better Auth's own JSON. Not wrapped in the DFFMS envelope. The exact body of each operation is not specified in this codebase.

Endpoints enabled by the configuration (paths confirmed from the installed Better Auth 1.7.6 package):

Method and path	Purpose	Notes
POST /sign-up/email	Register a public account	Rate limit 5 per minute. Sends verification email.
POST /sign-in/email	Sign in with email and password	Rate limit 10 per minute. Verified email required.
POST /sign-out	End the session
GET /get-session	Read the current session
POST /request-password-reset	Start password reset	Rate limit 3 per 5 minutes. Resets revoke other sessions.
POST /reset-password	Complete password reset
POST /verify-email and /send-verification-email	Email verification	Token expires in 30 minutes.
GET /sign-in/social, GET /callback/:id	Google sign-in	Only when Google is configured.
POST /two-factor/enable, /disable, /generate-backup-codes, /get-totp-uri, /send-otp, /verify-otp, /verify-totp, /verify-backup-code	Two-factor management and challenge	Rate limit 10 per minute. Account locks for 15 minutes after 5 failed attempts.
POST /passkey/generate-register-options, /passkey/verify-registration, /passkey/generate-authenticate-options, /passkey/verify-authentication, /passkey/authenticate, /passkey/register, GET /passkey/list-user-passkeys, POST /passkey/update-passkey, /passkey/delete-passkey	Passkey management	RP ID is the app host.

Example (sign-in):

curl -s -X POST https://dffms.org/api/v1/auth/sign-in/email \
  -H 'Content-Type: application/json' \
  -H 'Origin: https://dffms.org' \
  -d '{"email":"ada@demo.dffms.org","password":"<password>"}' \
  -c cookies.txt

• Side effects.
  • Account-security notices (in-app, email and push) are sent when sign-in protection changes.
  • Session creation records the last successful sign-in.
• Account types. accessType is PUBLIC_USER or STAFF_USER; status is ACTIVE, SUSPENDED, CLOSED or ARCHIVED. Users cannot set these fields through sign-up.