Public configuration for clients (tenant mode, email/phone/passwordless, OAuth client ids, registration, MFA, platform access, token mode). No auth required. Never includes secrets.

Client config

GET/auth/client-config

Public configuration for clients (tenant mode, email/phone/passwordless, OAuth client ids, registration, MFA, platform access, token mode). No auth required. Never includes secrets.

Responses

200Client configuration

ClientConfigResponseDto

Field	Type	Required	Description
`tenants`	`TenantsConfigDto`	optional
`multipleAccounts`	`MultipleAccountsConfigDto`	optional
`roleGuards`	`string[]`	optional	Example: `["web","api"]`
`emailAuth`	`EmailAuthConfigDto`	optional
`phoneAuth`	`PhoneAuthConfigDto`	optional
`passwordless`	`PasswordlessAuthConfigDto`	optional
`google`	`OAuthProviderPublicConfigDto`	optional
`facebook`	`OAuthProviderPublicConfigDto`	optional
`apple`	`OAuthProviderPublicConfigDto`	optional
`github`	`OAuthProviderPublicConfigDto`	optional
`customProviders`	`string[]`	optional	Example: `["ldap"]`
`registration`	`RegistrationConfigDto`	optional
`mfa`	`MfaConfigDto`	optional
`platformAccess`	`PlatformAccessPublicConfigDto`	optional
`accessTokenType`	`"header" \| "cookie" \| null`	optional	`headercookienull` Example: `header`
`sso`	`SsoConfigDto`	optional
`ui`	`UiConfigDto`	optional

Example response

{
  "tenants": {
    "enabled": true,
    "mode": "isolated",
    "options": [
      {
        "id": "string",
        "name": "string",
        "slug": "string",
        "isActive": false
      }
    ]
  },
  "multipleAccounts": {
    "enabled": false
  },
  "roleGuards": [
    "web",
    "api"
  ],
  "emailAuth": {
    "enabled": true
  },
  "phoneAuth": {
    "enabled": false
  },
  "passwordless": {
    "enabled": false,
    "allowSignUp": false
  },
  "google": {
    "enabled": false,
    "clientId": "1234567890-abcdef.apps.googleusercontent.com",
    "appId": "123456789012345"
  },
  "facebook": {
    "enabled": false,
    "clientId": "1234567890-abcdef.apps.googleusercontent.com",
    "appId": "123456789012345"
  },
  "apple": {
    "enabled": false,
    "clientId": "1234567890-abcdef.apps.googleusercontent.com",
    "appId": "123456789012345"
  },
  "github": {
    "enabled": false,
    "clientId": "1234567890-abcdef.apps.googleusercontent.com",
    "appId": "123456789012345"
  },
  "customProviders": [
    "ldap"
  ],
  "registration": {
    "enabled": true,
    "requireInvitation": false,
    "collectProfileFields": [
      {
        "id": "string",
        "label": "string",
        "required": false,
        "type": "text",
        "placeholder": "string",
        "options": [
          {
            "label": "string",
            "value": "string"
          }
        ]
      }
    ]
  },
  "mfa": {
    "enabled": true,
    "methods": [
      "email",
      "totp"
    ],
    "allowUserToggle": true,
    "allowMethodSelection": true
  },
  "platformAccess": {
    "enabled": false
  },
  "accessTokenType": "header",
  "sso": {
    "enabled": false,
    "providers": [
      {
        "id": "string",
        "name": "string",
        "logoUrl": "string",
        "authorizationUrl": "string",
        "clientId": "string",
        "hint": "string"
      }
    ]
  },
  "ui": {
    "brandName": "string",
    "brandColor": "string",
    "logoUrl": "string",
    "backgroundImageUrl": "string"
  }
}

400Validation failed (bad input).

ApiErrorResponseDto

Field	Type	Required	Description
`statusCode`	`number`	required	HTTP status code Example: `401`
`error`	`string`	required	HTTP status text / exception name Example: `Unauthorized`
`message`	`string`	required	Human-readable message Example: `Invalid credentials`
`code`	`string`	required	Stable, machine-readable error code — branch on this, not the message Example: `INVALID_CREDENTIALS`

Example response

{
  "statusCode": 401,
  "error": "Unauthorized",
  "message": "Invalid credentials",
  "code": "INVALID_CREDENTIALS"
}

401Missing, invalid, or expired authentication.

ApiErrorResponseDto

Field	Type	Required	Description
`statusCode`	`number`	required	HTTP status code Example: `401`
`error`	`string`	required	HTTP status text / exception name Example: `Unauthorized`
`message`	`string`	required	Human-readable message Example: `Invalid credentials`
`code`	`string`	required	Stable, machine-readable error code — branch on this, not the message Example: `INVALID_CREDENTIALS`

Example response

{
  "statusCode": 401,
  "error": "Unauthorized",
  "message": "Invalid credentials",
  "code": "INVALID_CREDENTIALS"
}

Try it

curl -X GET 'https://api.example.com/auth/client-config' \
  -H 'Content-Type: application/json' \
  -H 'Authorization: Bearer YOUR_ACCESS_TOKEN'

GET /auth/client-config

Client config

Responses

Try it

On this page