Overview
The LoginRadius Authentication APIs enable secure user registration, login, and profile management using email/username and password authentication. It supports custom workflows and token-based session management, providing flexible solutions for front-end and back-end integrations.
Usage and Security
- Authentication API endpoints do not require API Secret, ensuring safer front-end usage.
- Most endpoints require your LoginRadius API Key and the user's Access Token.
Retrieve LoginRadius API Key
- Log in to the Admin Console.
- Navigate to Tenant Settings and locate the API Configuration section. There, you will find the API Key required for most Authentication API endpoints.
Access Token:
- The access token is a unique session identifier generated upon successful authentication.
- It is unique to each login session and differs even for the same customer on repeated logins.
- The Token and the API Key will help LoginRadius identify the authenticated user.
- For details on how to pass access tokens to these APIs, refer to the Authentication Token Handling Guide.
Common Authentication API Endpoints
Here are the most commonly used endpoints in authentication workflows:
- Login Endpoints
- Registration Endpoint
- Profile Management Endpoints
- Verification Endpoints
- Delete Endpoints
Login endpoints allow customers to sign in using their registered credentials. These are essential for initiating a session and generating an access token for subsequent API calls.
| Action | Endpoint Description |
|---|---|
| Auth Login by Email | Log in using email and password. |
| Auth Login by Username | Log in using username and password. |
The registration endpoint enables users to create standard identity accounts. It’s typically used in sign-up forms and supports additional fields for custom user data.
| Action | Endpoint Description |
|---|---|
| Auth User Registration by Email | Create a standard user account using email and password. |
These APIs allow you to retrieve or update customer profile information once they are authenticated using an access token. It is ideal for building account settings pages and user dashboards.
| Action | Endpoint Description |
|---|---|
| Auth Read Profile by Token | Retrieve the user profile using the access token. |
| Auth Update Profile by Token | Update user profile information. |
| Auth Update Security Question by Access Token | Set or update security questions. |
Verification endpoints confirm the ownership of email addresses or phone numbers and help prevent spam or fraudulent registrations. They’re also useful for onboarding flows.
| Action | Endpoint Description |
|---|---|
| Auth Verify Email | Verify the user's email. |
| Auth Phone Verification by OTP | Verify a phone number using OTP. |
| Auth Resend Verification Email | Resend the email verification link. |
These APIs enable users to delete their accounts or remove secondary email addresses.
| Action | Endpoint Description |
|---|---|
| Auth Delete Account | Delete an account by passing a delete token. |
| Auth Remove Email | Remove additional emails from users' accounts. |
📌 Note: LoginRadius offers a public demo where developers can interact with Authentication APIs and test real-time integration scenarios.
Best Practices
- Use the API Key for front-end integration and keep the API Secret securely on the server side to prevent misuse or data exposure.
- Protect access tokens using HttpOnly and Secure flags (in cookies) or encrypted local/session storage to mitigate XSS attacks.
- Always validate access tokens on the server side before performing sensitive actions such as profile updates or account deletions.