# Nest Auth

> Full-featured authentication for NestJS, JavaScript, and React. Sessions, MFA, OAuth, passwordless, multi-tenancy, RBAC, and an embedded admin console — type-safe end to end.

Docs site: https://ack-solutions.github.io/nest-auth/
GitHub:    https://github.com/ack-solutions/nest-auth
Packages:  @ackplus/nest-auth, @ackplus/nest-auth-client, @ackplus/nest-auth-react, @ackplus/nest-auth-contracts

All pages on this site, grouped by section. The companion file at 
https://ack-solutions.github.io/nest-auth/llms-full.txt inlines every page body for context-window prefilling.

## Top-level

- [Welcome to Nest Auth](https://ack-solutions.github.io/nest-auth/docs/): Full-featured authentication for NestJS, JavaScript, and React.

## Introduction

- [What is Nest Auth?](https://ack-solutions.github.io/nest-auth/docs/introduction/): A full-featured, type-safe authentication suite for NestJS, JS, and React.
- [Architecture](https://ack-solutions.github.io/nest-auth/docs/introduction/architecture/): How the four Nest Auth packages fit together.
- [Philosophy](https://ack-solutions.github.io/nest-auth/docs/introduction/philosophy/): The design principles behind Nest Auth.

## Getting Started

- [Getting Started](https://ack-solutions.github.io/nest-auth/docs/getting-started/): Install, wire up, and run your first signup in 10 minutes.
- [Database Setup](https://ack-solutions.github.io/nest-auth/docs/getting-started/database-setup/): Three supported paths for creating the auth tables.
- [Environment & Secrets](https://ack-solutions.github.io/nest-auth/docs/getting-started/environment-and-secrets/): Required env vars and how to rotate them.
- [Installation](https://ack-solutions.github.io/nest-auth/docs/getting-started/installation/): What to install for backend, client, and React.
- [Quickstart — Backend](https://ack-solutions.github.io/nest-auth/docs/getting-started/quickstart-backend/): A minimal NestJS app with working signup and login.
- [Quickstart — Next.js](https://ack-solutions.github.io/nest-auth/docs/getting-started/quickstart-nextjs/): A minimal Next.js (App Router) app with SSR auth.
- [Quickstart — React](https://ack-solutions.github.io/nest-auth/docs/getting-started/quickstart-react/): A minimal React SPA with login, signup, and a protected route.
- [Quickstart — Vanilla JS](https://ack-solutions.github.io/nest-auth/docs/getting-started/quickstart-vanilla/): Plain `new AuthClient(...)` for non-React frontends.
- [Setup Checklist](https://ack-solutions.github.io/nest-auth/docs/getting-started/setup-checklist/): The boot-time wiring that catches every team the first time.

## Core Concepts

- [Core Concepts](https://ack-solutions.github.io/nest-auth/docs/concepts/): The mental models you need to use Nest Auth effectively.
- [Audit Logging](https://ack-solutions.github.io/nest-auth/docs/concepts/audit-logging/): Capture every auth event for compliance and security review.
- [Events & Hooks](https://ack-solutions.github.io/nest-auth/docs/concepts/events-and-hooks/): The primary extension surface — every auth lifecycle moment, exposed.
- [Multi-Factor Authentication](https://ack-solutions.github.io/nest-auth/docs/concepts/mfa/): TOTP, Email OTP, SMS OTP, recovery codes, and trusted devices.
- [Multi-Tenancy](https://ack-solutions.github.io/nest-auth/docs/concepts/multi-tenancy/): Single-tenant, shared multi-tenant, or fully isolated — Nest Auth supports all three.
- [RBAC — Roles & Permissions](https://ack-solutions.github.io/nest-auth/docs/concepts/rbac/): Role-based access control with multiple guards (web, api, mobile).
- [Request Context](https://ack-solutions.github.io/nest-auth/docs/concepts/request-context/): AsyncLocalStorage-backed per-request user, tenant, and session.
- [Session Storage](https://ack-solutions.github.io/nest-auth/docs/concepts/session-storage/): Pick between database, Redis, and memory session stores.
- [Sessions & Tokens](https://ack-solutions.github.io/nest-auth/docs/concepts/sessions-and-tokens/): How Nest Auth issues, refreshes, and validates JWT access and refresh tokens.
- [User Access & Platform Access](https://ack-solutions.github.io/nest-auth/docs/concepts/user-access-and-platform-access/): Per-tenant memberships vs cross-tenant super-admin roles.
- [User Model](https://ack-solutions.github.io/nest-auth/docs/concepts/user-model/): Why NestAuthUser only stores auth fields, and how to link your AppUser to it.

## Authentication Methods

- [Authentication Methods](https://ack-solutions.github.io/nest-auth/docs/authentication/): Feature-by-feature guides to every supported sign-in method.
- [API Keys](https://ack-solutions.github.io/nest-auth/docs/authentication/api-keys/): Server-to-server and programmatic access via public/private key pairs.
- [Custom OAuth / SSO Provider](https://ack-solutions.github.io/nest-auth/docs/authentication/custom-provider/): Plug in any provider not built in — Microsoft, Okta, Auth0, Discord, an internal SSO — with a full, end-to-end example.
- [Email + Password](https://ack-solutions.github.io/nest-auth/docs/authentication/email-password/): Classic email and password sign-up and sign-in.
- [Magic Link](https://ack-solutions.github.io/nest-auth/docs/authentication/magic-link/): Email-only sign-in via a one-click link.
- [Apple OAuth](https://ack-solutions.github.io/nest-auth/docs/authentication/oauth-apple/): Sign in with Apple.
- [Facebook OAuth](https://ack-solutions.github.io/nest-auth/docs/authentication/oauth-facebook/): Sign in with Facebook.
- [GitHub OAuth](https://ack-solutions.github.io/nest-auth/docs/authentication/oauth-github/): Sign in with GitHub.
- [Google OAuth](https://ack-solutions.github.io/nest-auth/docs/authentication/oauth-google/): Sign in with Google — supports both ID-token and access-token flows.
- [Passwordless OTP](https://ack-solutions.github.io/nest-auth/docs/authentication/passwordless-otp/): One-time codes over email or SMS — no password required.
- [Phone + Password](https://ack-solutions.github.io/nest-auth/docs/authentication/phone-password/): Phone-number-as-username sign-up and sign-in.
- [Social / SSO Login](https://ack-solutions.github.io/nest-auth/docs/authentication/social-sso/): How social sign-in (Google, Facebook, Apple, GitHub) and SSO work in Nest Auth — the one universal flow, the login request shape, account linking, and how to call it from every SDK.

## Backend reference (`@ackplus/nest-auth`)

- [Backend Reference](https://ack-solutions.github.io/nest-auth/docs/backend/): Full reference for `@ackplus/nest-auth`.
- [Admin Console](https://ack-solutions.github.io/nest-auth/docs/backend/admin-console/): The embedded admin dashboard.
- [Managing Platform Users](https://ack-solutions.github.io/nest-auth/docs/backend/admin-platform-users/): Find, inspect, and assign roles to platform (super-admin) users from the admin console.
- [Decorators](https://ack-solutions.github.io/nest-auth/docs/backend/decorators/): Every decorator exported from `@ackplus/nest-auth`.
- [Entities](https://ack-solutions.github.io/nest-auth/docs/backend/entities/): Every TypeORM entity in `@ackplus/nest-auth`.
- [Error Codes](https://ack-solutions.github.io/nest-auth/docs/backend/error-codes/): Every error code the library can return.
- [Events](https://ack-solutions.github.io/nest-auth/docs/backend/events/): Every emitted event class with its payload.
- [Guards](https://ack-solutions.github.io/nest-auth/docs/backend/guards/): NestAuthAuthGuard and AdminSessionGuard.
- [Hooks Reference](https://ack-solutions.github.io/nest-auth/docs/backend/hooks-reference/): Every config-time hook with its execution-order timeline.
- [NestAuthModule](https://ack-solutions.github.io/nest-auth/docs/backend/module/): Full reference for `NestAuthModule.forRoot()` and `forRootAsync()`.
- [Services](https://ack-solutions.github.io/nest-auth/docs/backend/services/): Public injectables — what's available via `@Inject()`.

## JS Client reference (`@ackplus/nest-auth-client`)

- [JS Client Reference](https://ack-solutions.github.io/nest-auth/docs/client/): Full reference for `@ackplus/nest-auth-client`.
- [AuthClient](https://ack-solutions.github.io/nest-auth/docs/client/client/): Every method on `new AuthClient(config)`.
- [Config](https://ack-solutions.github.io/nest-auth/docs/client/config/): AuthClientConfig reference.
- [Events](https://ack-solutions.github.io/nest-auth/docs/client/events/): Subscribing to client-side auth events.
- [HTTP Adapters](https://ack-solutions.github.io/nest-auth/docs/client/http-adapters/): Swap fetch for axios — or any HTTP transport.
- [Storage Adapters](https://ack-solutions.github.io/nest-auth/docs/client/storage-adapters/): Where header-mode tokens live on the client.
- [Utilities](https://ack-solutions.github.io/nest-auth/docs/client/utilities/): Standalone helpers exported from `@ackplus/nest-auth-client`.

## React reference (`@ackplus/nest-auth-react`)

- [React Reference](https://ack-solutions.github.io/nest-auth/docs/react/): Full reference for `@ackplus/nest-auth-react`.
- [Cross-Tab Sync](https://ack-solutions.github.io/nest-auth/docs/react/cross-tab-sync/): Keep auth state consistent across browser tabs.
- [Guards](https://ack-solutions.github.io/nest-auth/docs/react/guards/): Components and HOCs that protect routes and UI.
- [Hooks](https://ack-solutions.github.io/nest-auth/docs/react/hooks/): Every hook exported from `@ackplus/nest-auth-react`.
- [Next.js](https://ack-solutions.github.io/nest-auth/docs/react/nextjs/): createNextAuthHelpers, server-side auth, and App Router SSR.
- [Provider](https://ack-solutions.github.io/nest-auth/docs/react/provider/): <AuthProvider> and <NextAuthProvider> reference.

## Production

- [Production](https://ack-solutions.github.io/nest-auth/docs/production/): Turning a working dev setup into something safe to ship.
- [Compliance & Standards](https://ack-solutions.github.io/nest-auth/docs/production/compliance/): Which authentication standards and regulatory frameworks Nest Auth's controls map to — and the shared-responsibility model.
- [CORS & Security](https://ack-solutions.github.io/nest-auth/docs/production/cors-and-security/): Headers, CSRF, Helmet, and CSP for auth-mode browsers.
- [Customizing the JWT](https://ack-solutions.github.io/nest-auth/docs/production/customizing-jwt/): Add custom claims to the access token without bloating it.
- [Logging & Debugging](https://ack-solutions.github.io/nest-auth/docs/production/logging-and-debugging/): DebugLoggerService and the `debug` config.
- [Production Checklist](https://ack-solutions.github.io/nest-auth/docs/production/production-checklist/): Items to tick before sending traffic.
- [Rate Limiting](https://ack-solutions.github.io/nest-auth/docs/production/rate-limiting/): Throttling auth endpoints against credential stuffing and abuse.
- [Scaling](https://ack-solutions.github.io/nest-auth/docs/production/scaling/): Redis sessions, multi-instance, sliding expiration trade-offs, performance.
- [Sending Emails](https://ack-solutions.github.io/nest-auth/docs/production/sending-emails/): Wire auth events to Resend, SendGrid, AWS SES, or Postmark.
- [Sending SMS](https://ack-solutions.github.io/nest-auth/docs/production/sending-sms/): Wire phone-related events to Twilio or MessageBird.
- [Testing Your Auth](https://ack-solutions.github.io/nest-auth/docs/production/testing-your-auth/): Mocking guards, seeding test users, writing E2E flows.

## Recipes

- [Recipes](https://ack-solutions.github.io/nest-auth/docs/recipes/): Copy-paste solutions to common problems — browse all recipes below.
- [Suspend and reactivate accounts](https://ack-solutions.github.io/nest-auth/docs/recipes/account-suspension/): `ACCOUNT_INACTIVE` vs `ACCOUNT_SUSPENDED` — which to use when.
- [Custom JWT claims](https://ack-solutions.github.io/nest-auth/docs/recipes/custom-jwt-claims/): Add `subscriptionTier`, `appUserId`, or feature flags to the access token.
- [Custom OAuth Provider](https://ack-solutions.github.io/nest-auth/docs/recipes/custom-oauth-provider/): Add Discord, Microsoft, Slack — anything not in the built-in list.
- [Custom trusted-device header name](https://ack-solutions.github.io/nest-auth/docs/recipes/custom-trusted-device-header/): Rename `nest_auth_device_trust` to match your app's conventions.
- [External role resolver (Okta / Auth0 / custom IDP)](https://ack-solutions.github.io/nest-auth/docs/recipes/external-role-resolver/): Roles live in your IDP, not your DB.
- [Extra signup fields with `collectProfileFields`](https://ack-solutions.github.io/nest-auth/docs/recipes/extra-signup-fields/): Render a dynamic signup form driven by server config.
- [Force password change (temporary passwords)](https://ack-solutions.github.io/nest-auth/docs/recipes/force-password-change/): Make an admin-set temporary password genuinely temporary — the user can do exactly one thing with it: set a new one.
- [IP allowlist via `guards.beforeAuth`](https://ack-solutions.github.io/nest-auth/docs/recipes/ip-allowlist-guard/): Lock down auth-protected endpoints to known IPs.
- [Link multiple OAuth providers to one account](https://ack-solutions.github.io/nest-auth/docs/recipes/link-multiple-providers/): Let one user sign in with both Google and GitHub.
- [MFA recovery codes — generate, show, store](https://ack-solutions.github.io/nest-auth/docs/recipes/mfa-recovery-codes/): One-time codes the user needs to reach if they lose their authenticator.
- [Migrate existing users](https://ack-solutions.github.io/nest-auth/docs/recipes/migrate-existing-users/): Adopt Nest Auth in an existing app that already has a `users` table.
- [Multi-account login & switching](https://ack-solutions.github.io/nest-auth/docs/recipes/multi-account-switching/): Let one client log into several accounts at once and switch the active one — Gmail/Slack-style — in header or cookie mode.
- [Multi-platform login with guards](https://ack-solutions.github.io/nest-auth/docs/recipes/multi-platform-login/): One backend serving an admin console, a tenant portal, and a mobile app — with origin-aware login gating.
- [Next.js dashboard behind `<RequireRole>`](https://ack-solutions.github.io/nest-auth/docs/recipes/nextjs-protected-dashboard/): A Next.js App Router dashboard gated by role, with SSR auth.
- [`normalizedEmail` / `normalizedPhone` for consistent identity](https://ack-solutions.github.io/nest-auth/docs/recipes/normalize-email-phone/): Avoid duplicate users from inconsistent input.
- [Custom error transformation per flow](https://ack-solutions.github.io/nest-auth/docs/recipes/per-flow-error-transform/): Reshape errors per auth flow with `errorHandler(error, context)`.
- [Per-request config — mobile vs web](https://ack-solutions.github.io/nest-auth/docs/recipes/per-request-config/): Mobile sends Bearer, web sends cookie — one backend, both clients.
- [Platform-admin portal](https://ack-solutions.github.io/nest-auth/docs/recipes/platform-admin-portal/): A "manage the entire platform" portal — full nest-auth users with a cross-tenant super-admin role, origin-locked and optionally MFA-gated.
- [Pre-built React auth forms](https://ack-solutions.github.io/nest-auth/docs/recipes/react-auth-forms/): Copy-paste login, signup, MFA challenge, and forgot-password forms.
- [Remember this device with trusted-device tokens](https://ack-solutions.github.io/nest-auth/docs/recipes/remember-this-device/): Skip MFA on familiar browsers without compromising security.
- [Seeding roles & permissions](https://ack-solutions.github.io/nest-auth/docs/recipes/seeding-roles-and-permissions/): Idempotent bootstrap of system roles, permissions, and assignments.
- [Single notification service for email + SMS](https://ack-solutions.github.io/nest-auth/docs/recipes/single-notification-service/): One listener, every transactional auth event.
- [Logging in under a tenant (ISOLATED)](https://ack-solutions.github.io/nest-auth/docs/recipes/tenant-login-isolated/): How login resolves the tenant in ISOLATED mode — slug → tenantId, the login DTO, password reset, and the invite pattern.
- [Tenant-picker dropdown](https://ack-solutions.github.io/nest-auth/docs/recipes/tenant-switcher/): Let multi-tenant users switch between their workspaces.
- [Transactional user creation (NestAuthUser + AppUser in one rollback)](https://ack-solutions.github.io/nest-auth/docs/recipes/transactional-user-creation/): Wrap signup-style flows in a TypeORM transaction so a failure halfway through doesn't leave a half-created user in `nest_auth_users`.
- [React to login with `UserLoggedInEvent`](https://ack-solutions.github.io/nest-auth/docs/recipes/user-logged-in-listener/): Last-login tracking, role sync, audit writes.
- [React to a new signup with `UserRegisteredEvent`](https://ack-solutions.github.io/nest-auth/docs/recipes/user-registered-listener/): Create your AppUser, link a referral, queue a welcome email — all in one listener.

## API Reference

- [All Endpoints](https://ack-solutions.github.io/nest-auth/docs/api-reference/): Generated reference for every operation in the OpenAPI spec.
- [DELETE /auth/admin/api/blocked-email-domains/{idOrDomain}](https://ack-solutions.github.io/nest-auth/docs/api-reference/admin-blocked-email-domains/delete-auth-admin-api-blocked-email-domains-idordomain/): Remove a blocked domain (by id or domain)
- [GET /auth/admin/api/blocked-email-domains](https://ack-solutions.github.io/nest-auth/docs/api-reference/admin-blocked-email-domains/get-auth-admin-api-blocked-email-domains/): List blocked email domains (searchable, paginated)
- [GET /auth/admin/api/blocked-email-domains/stats](https://ack-solutions.github.io/nest-auth/docs/api-reference/admin-blocked-email-domains/get-auth-admin-api-blocked-email-domains-stats/): Blocklist stats (current count + size of the built-in default list)
- [POST /auth/admin/api/blocked-email-domains](https://ack-solutions.github.io/nest-auth/docs/api-reference/admin-blocked-email-domains/post-auth-admin-api-blocked-email-domains/): Add one or more blocked domains
- [POST /auth/admin/api/blocked-email-domains/import-defaults](https://ack-solutions.github.io/nest-auth/docs/api-reference/admin-blocked-email-domains/post-auth-admin-api-blocked-email-domains-import-defaults/): Import the built-in default disposable-domain list
- [DELETE /auth/admin/admins/{id}](https://ack-solutions.github.io/nest-auth/docs/api-reference/admin-console/delete-auth-admin-admins-id/): Delete an admin
- [GET /auth/admin/admins](https://ack-solutions.github.io/nest-auth/docs/api-reference/admin-console/get-auth-admin-admins/): List admins
- [GET /auth/admin/api/stats](https://ack-solutions.github.io/nest-auth/docs/api-reference/admin-console/get-auth-admin-api-stats/): Dashboard stats
- [GET /auth/admin/config](https://ack-solutions.github.io/nest-auth/docs/api-reference/admin-console/get-auth-admin-config/): Public admin-console config
- [GET /auth/admin/me](https://ack-solutions.github.io/nest-auth/docs/api-reference/admin-console/get-auth-admin-me/): Current admin
- [PATCH /auth/admin/admins/{id}](https://ack-solutions.github.io/nest-auth/docs/api-reference/admin-console/patch-auth-admin-admins-id/): Update an admin
- [POST /auth/admin/admins](https://ack-solutions.github.io/nest-auth/docs/api-reference/admin-console/post-auth-admin-admins/): Create an admin
- [POST /auth/admin/login](https://ack-solutions.github.io/nest-auth/docs/api-reference/admin-console/post-auth-admin-login/): Admin login (sets the session cookie)
- [POST /auth/admin/logout](https://ack-solutions.github.io/nest-auth/docs/api-reference/admin-console/post-auth-admin-logout/): Admin logout
- [POST /auth/admin/reset-password](https://ack-solutions.github.io/nest-auth/docs/api-reference/admin-console/post-auth-admin-reset-password/): Reset an admin's password (secret-key gated recovery)
- [POST /auth/admin/signup](https://ack-solutions.github.io/nest-auth/docs/api-reference/admin-console/post-auth-admin-signup/): Bootstrap the first admin (secret-key gated)
- [DELETE /auth/admin/api/permissions/{id}](https://ack-solutions.github.io/nest-auth/docs/api-reference/admin-permissions/delete-auth-admin-api-permissions-id/): Delete a permission
- [GET /auth/admin/api/permissions](https://ack-solutions.github.io/nest-auth/docs/api-reference/admin-permissions/get-auth-admin-api-permissions/): List permissions
- [GET /auth/admin/api/permissions/categories](https://ack-solutions.github.io/nest-auth/docs/api-reference/admin-permissions/get-auth-admin-api-permissions-categories/): List permission categories
- [GET /auth/admin/api/permissions/guards](https://ack-solutions.github.io/nest-auth/docs/api-reference/admin-permissions/get-auth-admin-api-permissions-guards/): List guard namespaces
- [GET /auth/admin/api/permissions/{id}](https://ack-solutions.github.io/nest-auth/docs/api-reference/admin-permissions/get-auth-admin-api-permissions-id/): Get a permission
- [GET /auth/admin/api/permissions/search](https://ack-solutions.github.io/nest-auth/docs/api-reference/admin-permissions/get-auth-admin-api-permissions-search/): Search permissions
- [PATCH /auth/admin/api/permissions/{id}](https://ack-solutions.github.io/nest-auth/docs/api-reference/admin-permissions/patch-auth-admin-api-permissions-id/): Update a permission
- [POST /auth/admin/api/permissions](https://ack-solutions.github.io/nest-auth/docs/api-reference/admin-permissions/post-auth-admin-api-permissions/): Create a permission
- [DELETE /auth/admin/api/roles/{id}](https://ack-solutions.github.io/nest-auth/docs/api-reference/admin-roles/delete-auth-admin-api-roles-id/): Delete a role
- [GET /auth/admin/api/roles](https://ack-solutions.github.io/nest-auth/docs/api-reference/admin-roles/get-auth-admin-api-roles/): List roles
- [PATCH /auth/admin/api/roles/{id}](https://ack-solutions.github.io/nest-auth/docs/api-reference/admin-roles/patch-auth-admin-api-roles-id/): Update a role
- [POST /auth/admin/api/roles](https://ack-solutions.github.io/nest-auth/docs/api-reference/admin-roles/post-auth-admin-api-roles/): Create a role
- [DELETE /auth/admin/api/tenants/{id}](https://ack-solutions.github.io/nest-auth/docs/api-reference/admin-tenants/delete-auth-admin-api-tenants-id/): Delete a tenant
- [GET /auth/admin/api/tenants](https://ack-solutions.github.io/nest-auth/docs/api-reference/admin-tenants/get-auth-admin-api-tenants/): List tenants
- [PATCH /auth/admin/api/tenants/{id}](https://ack-solutions.github.io/nest-auth/docs/api-reference/admin-tenants/patch-auth-admin-api-tenants-id/): Update a tenant
- [POST /auth/admin/api/tenants](https://ack-solutions.github.io/nest-auth/docs/api-reference/admin-tenants/post-auth-admin-api-tenants/): Create a tenant
- [DELETE /auth/admin/api/users/{id}](https://ack-solutions.github.io/nest-auth/docs/api-reference/admin-users/delete-auth-admin-api-users-id/): Delete a user
- [DELETE /auth/admin/api/users/{id}/sessions](https://ack-solutions.github.io/nest-auth/docs/api-reference/admin-users/delete-auth-admin-api-users-id-sessions/): Revoke all of a user's sessions
- [DELETE /auth/admin/api/users/{id}/sessions/{sessionId}](https://ack-solutions.github.io/nest-auth/docs/api-reference/admin-users/delete-auth-admin-api-users-id-sessions-sessionid/): Revoke a single user session
- [DELETE /auth/admin/api/users/{id}/totp-devices/{deviceId}](https://ack-solutions.github.io/nest-auth/docs/api-reference/admin-users/delete-auth-admin-api-users-id-totp-devices-deviceid/): Remove a user's TOTP device
- [GET /auth/admin/api/users](https://ack-solutions.github.io/nest-auth/docs/api-reference/admin-users/get-auth-admin-api-users/): List users (paginated, cross-tenant; filter by scope/status/tenant/role/search)
- [GET /auth/admin/api/users/{id}](https://ack-solutions.github.io/nest-auth/docs/api-reference/admin-users/get-auth-admin-api-users-id/): Get a user (with roles, sessions, identities)
- [GET /auth/admin/api/users/{id}/sessions](https://ack-solutions.github.io/nest-auth/docs/api-reference/admin-users/get-auth-admin-api-users-id-sessions/): List a user's active sessions
- [PATCH /auth/admin/api/users/{id}](https://ack-solutions.github.io/nest-auth/docs/api-reference/admin-users/patch-auth-admin-api-users-id/): Update a user
- [POST /auth/admin/api/users](https://ack-solutions.github.io/nest-auth/docs/api-reference/admin-users/post-auth-admin-api-users/): Create a user
- [GET /auth/accounts](https://ack-solutions.github.io/nest-auth/docs/api-reference/authentication/get-auth-accounts/): Cookie-mode account switcher: lists the accounts this browser is logged into, derived from the per-account token cookies it holds (httpOnly tokens are never returned — only id/email/tenant + which ...
- [GET /auth/callback/{provider}](https://ack-solutions.github.io/nest-auth/docs/api-reference/authentication/get-auth-callback-provider/): OAuth callback endpoint for SSO providers. Exchanges authorization code for access token and returns raw SSO user info. Returns HTML page that posts SSO data to parent window and auto-closes.
- [GET /auth/client-config](https://ack-solutions.github.io/nest-auth/docs/api-reference/authentication/get-auth-client-config/): Public configuration for clients (tenant mode, email/phone/passwordless, OAuth client ids, registration, MFA, platform access, token mode). No auth required. Never includes secrets.
- [GET /auth/csrf](https://ack-solutions.github.io/nest-auth/docs/api-reference/authentication/get-auth-csrf/): Cookie mode: sets/rotates the double-submit CSRF cookie and returns the token to echo in the CSRF header (default `x-csrf-token`) on state-changing requests. Call with credentials so the cookie is ...
- [GET /auth/me](https://ack-solutions.github.io/nest-auth/docs/api-reference/authentication/get-auth-me/): Get Session User Data and menage extra user data from config
- [GET /auth/tenants/lookup](https://ack-solutions.github.io/nest-auth/docs/api-reference/authentication/get-auth-tenants-lookup/): ISOLATED-mode login helper: resolve a tenant slug to its id so the login form can supply the right tenantId (the same email is a distinct account per tenant). Returns minimal public fields; 404 if ...
- [GET /auth/user](https://ack-solutions.github.io/nest-auth/docs/api-reference/authentication/get-auth-user/): Get Logged In User
- [GET /auth/verify-session](https://ack-solutions.github.io/nest-auth/docs/api-reference/authentication/get-auth-verify-session/): Lightweight endpoint to verify if the current session is valid. Returns minimal information without fetching full user data.
- [POST /auth/change-password](https://ack-solutions.github.io/nest-auth/docs/api-reference/authentication/post-auth-change-password/): Change Password
- [POST /auth/forgot-password](https://ack-solutions.github.io/nest-auth/docs/api-reference/authentication/post-auth-forgot-password/): Forgot password
- [POST /auth/invite](https://ack-solutions.github.io/nest-auth/docs/api-reference/authentication/post-auth-invite/): Create-or-link a user in the tenant and emit a `nest_auth.user_invited` event carrying a single-use set-password token, so YOUR listener can email the invite link (the token is intentionally NEVER ...
- [POST /auth/login](https://ack-solutions.github.io/nest-auth/docs/api-reference/authentication/post-auth-login/): Authenticate user. Response format depends on accessTokenType configuration:
- [POST /auth/logout](https://ack-solutions.github.io/nest-auth/docs/api-reference/authentication/post-auth-logout/): Logout
- [POST /auth/logout-all](https://ack-solutions.github.io/nest-auth/docs/api-reference/authentication/post-auth-logout-all/): Logout All
- [POST /auth/mfa/verify](https://ack-solutions.github.io/nest-auth/docs/api-reference/authentication/post-auth-mfa-verify/): Verify multi-factor authentication. Response format depends on accessTokenType configuration:
- [POST /auth/mfa/verify-recovery-code](https://ack-solutions.github.io/nest-auth/docs/api-reference/authentication/post-auth-mfa-verify-recovery-code/): Redeem a single-use recovery (backup) code to COMPLETE the sign-in. Unlike reset-totp, MFA stays enabled and the enrolled factors are untouched — the code acts as a backup authenticator. Returns a ...
- [POST /auth/passwordless/send](https://ack-solutions.github.io/nest-auth/docs/api-reference/authentication/post-auth-passwordless-send/): Passwordless — send login code (email or SMS)
- [POST /auth/refresh-token](https://ack-solutions.github.io/nest-auth/docs/api-reference/authentication/post-auth-refresh-token/): Refresh access token. Response format depends on accessTokenType configuration:
- [POST /auth/reset-password](https://ack-solutions.github.io/nest-auth/docs/api-reference/authentication/post-auth-reset-password/): Reset password
- [POST /auth/send-email-verification](https://ack-solutions.github.io/nest-auth/docs/api-reference/authentication/post-auth-send-email-verification/): Send email verification
- [POST /auth/send-phone-verification](https://ack-solutions.github.io/nest-auth/docs/api-reference/authentication/post-auth-send-phone-verification/): Send phone verification (SMS OTP)
- [POST /auth/signup](https://ack-solutions.github.io/nest-auth/docs/api-reference/authentication/post-auth-signup/): Register a new user. Response format depends on accessTokenType configuration:
- [POST /auth/switch-tenant](https://ack-solutions.github.io/nest-auth/docs/api-reference/authentication/post-auth-switch-tenant/): Switch Active Tenant
- [POST /auth/verify-email](https://ack-solutions.github.io/nest-auth/docs/api-reference/authentication/post-auth-verify-email/): Verify Email
- [POST /auth/verify-forgot-password-otp](https://ack-solutions.github.io/nest-auth/docs/api-reference/authentication/post-auth-verify-forgot-password-otp/): Verify Forgot Password OTP and get reset token
- [POST /auth/verify-phone](https://ack-solutions.github.io/nest-auth/docs/api-reference/authentication/post-auth-verify-phone/): Verify phone number with OTP
- [DELETE /auth/mfa/devices/{deviceId}](https://ack-solutions.github.io/nest-auth/docs/api-reference/mfa/delete-auth-mfa-devices-deviceid/): Remove a registered MFA device
- [GET /auth/mfa/devices](https://ack-solutions.github.io/nest-auth/docs/api-reference/mfa/get-auth-mfa-devices/): List registered MFA devices
- [GET /auth/mfa/status](https://ack-solutions.github.io/nest-auth/docs/api-reference/mfa/get-auth-mfa-status/): Get MFA status for the current user
- [POST /auth/mfa/challenge](https://ack-solutions.github.io/nest-auth/docs/api-reference/mfa/post-auth-mfa-challenge/): Send MFA code for setup/verification
- [POST /auth/mfa/generate-recovery-code](https://ack-solutions.github.io/nest-auth/docs/api-reference/mfa/post-auth-mfa-generate-recovery-code/): Generate Recovery Codes
- [POST /auth/mfa/reset-totp](https://ack-solutions.github.io/nest-auth/docs/api-reference/mfa/post-auth-mfa-reset-totp/): Reset TOTP Device
- [POST /auth/mfa/setup-totp](https://ack-solutions.github.io/nest-auth/docs/api-reference/mfa/post-auth-mfa-setup-totp/): Setup TOTP Device
- [POST /auth/mfa/toggle](https://ack-solutions.github.io/nest-auth/docs/api-reference/mfa/post-auth-mfa-toggle/): Enable or disable MFA for the current user
- [POST /auth/mfa/verify-totp-setup](https://ack-solutions.github.io/nest-auth/docs/api-reference/mfa/post-auth-mfa-verify-totp-setup/): Verify TOTP Setup
- [REST Endpoints](https://ack-solutions.github.io/nest-auth/docs/api-reference/rest/): Auto-generated from the OpenAPI spec.
- [Types Reference](https://ack-solutions.github.io/nest-auth/docs/api-reference/types/): Auto-generated from the source.

## Changelog

- [Changelog](https://ack-solutions.github.io/nest-auth/docs/changelog/): What's new in each release of @ackplus/nest-auth.

## FAQ & Troubleshooting

- [FAQ](https://ack-solutions.github.io/nest-auth/docs/faq/): Top developer questions, with deep links into the rest of the docs.
- [Troubleshooting](https://ack-solutions.github.io/nest-auth/docs/faq/troubleshooting/): Error code → likely cause → fix.